Expose Metal external buffer-write interop

[jcwal1516]

Summary

• expose ownership-safe retained Metal device, queue, and buffer handles
• add an unsafe, range-scoped API for registering completed external buffer writes with wgpu's lazy initialization tracker
• validate empty, reversed, overflowing, and out-of-bounds ranges without modifying tracker state on failure
• cover Objective-C ownership, initialization tracking, and a real Metal external-write round trip

Motivation

A native asynchronous producer such as an image decoder needs to fill a wgpu::Buffer directly and then return that allocation to an ordinary wgpu consumer. On Metal, the external submission must retain the native device, queue, and buffer beyond the as_hal guard. Once the write has completed with the required queue ordering, wgpu must also learn that the exact written range is initialized so a later lazy clear does not overwrite it.

The concrete downstream use case is a JPEG 2000/HTJ2K decoder writing directly into a Burn tensor backed by wgpu. Decoded pixels never make a host round trip. This API does not submit or synchronize work; synchronization remains the external producer's responsibility.

Safety contract

• Each retained Metal handle transfers one Objective-C +1 ownership reference that the caller must release or adopt exactly once.
• Buffer::mark_external_write_initialized changes only initialization tracking and validates the requested range.
• The caller must keep the buffer alive, complete the external write, and establish queue ordering before any later wgpu use.

Validation

• cargo test -p wgpu-core device::external_write --lib
• cargo test -p wgpu range_to_offset_size --lib
• cargo test -p wgpu-hal --features metal retained_queue_and_buffer_handles_outlive_their_hal_wrappers --lib
• cargo test -p wgpu-core --lib
• cargo test -p wgpu --lib
• cargo test -p wgpu-hal --features metal --lib
• cargo xtask test -E 'test(/metal_external_buffer_write/)' on Apple M4 Pro
• cargo clippy -p wgpu-core -p wgpu-hal -p wgpu -p wgpu-test --tests -- -D warnings
• cargo build
• cargo fmt --all -- --check
• git diff --check

Closes #9928.
Related to #4067 and tracel-ai/cubecl#1443.