feat(memory): slab-backed lambda closures + Bitmap buffer allocation

[JeanPhilippeKernel]

Closes §10.2 and §10.3 of tlsf-allocator-integration.md.

§10.2 — Lambda closure slab

ThreadPool gets a shared 512 KB m_closure_slab (carved from Device->Arena by RRM alongside upload slabs). Submit<T> allocates [TLSFSlab* header | Fn closure] in one TLSF block instead of new/delete. The callback reads the header to free via slab or ::operator delete. Falls back to ::operator new when InitClosureSlab has not been called (early startup, tests). Eliminates the last system-heap alloc on the upload hot path.

§10.3 — Bitmap slab-aware allocation

Replaces std::vector<uint8_t> Buffer with uint8_t* Buffer + size_t BufferSize + TLSFSlab* Slab. Constructors accept an optional slab param; AllocNoZero skips zeroing for data constructors that immediately overwrite. Explicit destructor frees via slab->Free or delete[]. Copy deleted; move transfers ownership and nulls the source.

Static methods EquirectangularMapToVerticalCross and VerticalCrossToCubemap forward the slab so all intermediate Bitmaps live on the worker slab.

RenderResourceManager: std::vector<float> output_buf on the HDR equirect path replaced by a slab-backed float*. All Bitmap intermediates are now slab-backed.

EnvironmentMapImporter: passes GetWorkerSlab() to all Bitmap constructors and static methods.

Test plan

• All existing allocator and bitmap tests pass
• Manual: HDR cubemap import — all intermediate Bitmaps freed from slab after upload, no arena growth
• Submit fallback path works when closure slab not yet initialized (pre-RRM tests)