Render: integrated workspace, preview image jobs and opaque PBR (#1046)

Lands the Render workspace (R3), bounded preview-image jobs with cancellation and atomic PNG export (R4a), and opaque PBR looks as one change.

- Render workspace: an overlay-free product preview on the installed GPU device. Returning to Design restores its camera. render.scene and render.settings.apply are added.
- Image jobs: render.preflight/start/status/cancel/export run bounded CPU preview jobs. Export captures the job, overwrite choice and document, and checks the caller's file scope before writing.
- Opaque PBR: looks can carry metal fraction, roughness and dielectric IOR. The product viewport and preview PNG use them; geometry and mass are unchanged. The v1 catalog export refuses PBR rather than dropping it.
- Render setups and PBR looks are saved under design format 21. Labels are in en/de/ja/ko/zh/ru.

Supersedes #706 and #800. Refs #620, #673, #756, #1004.

Contributed by @0xlillith.

Co-authored-by: lillith <[email protected]>

docs/render-backends.md

@@ -1,5 +1,9 @@
 # Render backend capabilities (R1)
 
+This page describes the R1 metadata contract. The installed GPU viewport and CPU
+product-job hosts extend it through complete profiles; HDR input preparation adds
+no lighting capability. See [the integrated phase boundaries](render-integration.md).
+
 `render.backends` discovers render metadata without opening a window, probing a GPU,
 evaluating the model or changing the document, camera, dirty state or undo/redo history.
 It also leaves a model made stale by a live sketch gesture stale.
@@ -55,11 +59,13 @@ descriptors, not design-file settings. Executor IDs are scoped to their backend.
 Backend/executor IDs are 1–64 ASCII bytes: a lowercase letter followed by lowercase
 letters, digits, `.`, `_` or `-`. Both construction and deserialization validate IDs.
 
-The integrated backend currently describes only the existing CPU raster snapshot
+Without runtime hosts the integrated backend describes the existing CPU raster snapshot
 path. Its `preview`/`image` profile exports PNG; it does not claim HDRI, PBR,
 refraction, progressive rendering or a final-quality integrator. The existing GPU
-viewport remains separate and is not advertised here until a GPU host can register
-and probe its actual capabilities. CPU and GPU are execution paths, not separate
+viewport registers separately when the UI installs its actual device/pipelines.
+The installed GPU product viewport and CPU product-image host support the subsequent
+[opaque PBR consumer](render-opaque-pbr.md); this does not alter the static raster
+descriptor or enable HDRI/refraction/final rendering. CPU and GPU are execution paths, not separate
 user-selectable engine families.
 
 ## Pure request resolution