ifcviewer: budget the geometry cache and make required allocations fallible

Loading enough models drove the chunk pool to the driver's refusal point,
after which the first click aborted: the pick attachments are allocated
lazily, wgpu-native reported their OOM as a validation error nobody
observed, and the invalid views reached wgpuQueueSubmit, which panics
across the FFI boundary. Two policy defects compounding: the cache was
allowed to take the last byte, and nothing but the pool's own growth was
treated as fallible.

GPU memory is now two tiers. Required allocations (per-pixel attachments,
a model's metadata buffers, readback staging) are eager, deterministic
and fallible; the chunk pool is an elastic cache that grows only to a
budget and yields whenever a required allocation fails.

- GpuBudget (pure, unit-tested): desktop derives the budget from the
  driver's free-memory report minus a reserve for the attachments at 4K;
  web keeps the wasm-heap cap; either lowers it on pressure. The budget's
  source differs per platform, the mechanism does not.
- GpuAllocScope: the OOM/Validation error-scope dance in one place,
  synchronous on wgpu-native, provisional on Dawn-web. BufferPool's
  inline copy now uses it.
- BufferPool::shrinkToCapacity releases whole sub-buffers newest-first
  after the owner empties them; growth clamps to the budget instead of
  overshooting.
- ViewportCore::allocateRequired runs any required creation under a
  scope and, on failure, lowers the budget, evicts and releases cache
  sub-buffers, waits for the device to reclaim them, and retries until
  it fits or the cache is at its floor. Pick attachments are created with
  the other attachments in configureSurface; render() skips a frame
  rather than submit invalid views; a model whose buffers cannot fit is
  not loaded instead of aborting.

Verified on a 4 GB GeForce: the pool clamps itself at the derived budget
(256+256+67 MB for a 579 MB budget) and, in a standalone check against
the real device, a pool grown to the driver's refusal point observes a
failed required allocation, releases 320 MB and succeeds on retry.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/ifcviewer/GpuBudget.cpp

@@ -0,0 +1,60 @@
+/********************************************************************************
+ *                                                                              *
+ * This file is part of IfcOpenShell.                                           *
+ *                                                                              *
+ * IfcOpenShell is free software: you can redistribute it and/or modify         *
+ * it under the terms of the Lesser GNU General Public License as published by  *
+ * the Free Software Foundation, either version 3.0 of the License, or          *
+ * (at your option) any later version.                                          *
+ *                                                                              *
+ * IfcOpenShell is distributed in the hope that it will be useful,              *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of               *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the                 *
+ * Lesser GNU General Public License for more details.                          *
+ *                                                                              *
+ * You should have received a copy of the Lesser GNU General Public License     *
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.         *
+ *                                                                              *
+ ********************************************************************************/
+
+#include "GpuBudget.h"
+
+#include <algorithm>
+
+void GpuBudget::configure(std::uint64_t device_free_bytes,
+                          std::uint64_t reserve_bytes,
+                          std::uint64_t hard_cap_bytes) {
+    bounded_ = false;
+    budget_  = 0;
+    if (device_free_bytes > 0) {
+        bounded_ = true;
+        budget_  = device_free_bytes > reserve_bytes
+                 ? device_free_bytes - reserve_bytes
+                 : 0;
+    }
+    if (hard_cap_bytes > 0) {
+        budget_  = bounded_ ? std::min(budget_, hard_cap_bytes) : hard_cap_bytes;
+        bounded_ = true;
+    }
+    if (bounded_) budget_ = std::max(budget_, kMinCacheBudgetBytes);
+}
+
+bool GpuBudget::onPressure(std::uint64_t cache_capacity_bytes,
+                           std::uint64_t bytes_needed) {
+    ++pressure_events_;
+    // What the cache may keep once the failed allocation and its slack
+    // have been carved out of what it holds right now. The pool's actual
+    // capacity, not the previous budget, is the honest baseline: the
+    // budget may never have been reached (unbounded, or growth refused
+    // earlier by the driver), and lowering a number the pool never hit
+    // would free nothing.
+    const std::uint64_t carve  = bytes_needed + kPressureSlackBytes;
+    const std::uint64_t target = cache_capacity_bytes > carve
+                               ? cache_capacity_bytes - carve
+                               : 0;
+    const std::uint64_t lowered = std::max(target, kMinCacheBudgetBytes);
+    if (bounded_ && lowered >= budget_) return false;
+    bounded_ = true;
+    budget_  = lowered;
+    return true;
+}