Protect selected windows from screen capture

Add capture privacy rules for windows, transient children, overview previews and client cursors, with separate capture rendering and deferred-frame invalidation. Keep detached close snapshots out of captures after clients leave the registry.

Validated with release workspace tests, private compositor/EGL regressions, and an isolated release PipeWire capture test.

compositor/src/state/outputs.rs

@@ -101,6 +101,7 @@ impl Ferese {
         self.output_redraw_pending.retain(|pending| pending != output);
         if let Some(id) = self.output_ids.get(output) {
             self.render.remove_output(*id);
+            self.capture_render.remove_output(*id);
         }
         self.pending_screencopies.retain(|capture| {
             if capture.output == *output {