Render URL-backed SVG masks

[wieslawsoltes]

Problem and result

Unchanged Code OSS uses URL-backed SVG masks for activity, view, file, progress, welcome, extension, MCP, release-note, and theme icons. The retained engine previously projected only linear-gradient masks, leaving these consumers unmasked or rendered as solid rectangles.

This dependent stack change:

• loads allowed SVG mask URLs through the existing host policy and CSS SVG loader;
• publishes versioned webscene-mask-svg-v1 resources with viewBox, repeat, position, size, and immutable markup;
• keeps mask paint inside the existing kind-30/kind-47 isolated group;
• projects tiled SVG alpha through one bounded DstIn layer in Skia/Avalonia/Uno and Flutter;
• reuses the shared Skia SVG picture cache and adds a bounded synchronous Flutter geometry cache;
• preserves intrinsic aspect, contain/cover/auto, length/percentage sizing, position, and repeat axes;
• clears uncovered no-repeat regions and fails closed for failed or unsupported resources via webscene-mask-invalid-v1;
• authors retained-command and repeated-tile backend regression coverage;
• records scope, performance design, unsupported forms, and deferred gates in docs/validation/css-svg-mask-20260919.md.

Flutter support in this slice is deliberately bounded to untransformed filled path, rect, circle, ellipse, and polygon geometry. Groups, defs/use, embedded images, text, strokes, transforms, unsupported fill rules, raster masks, multiple layers, luminance mode, and non-add composites remain explicit fail-closed boundaries.

GitHub stack

1. Provider: Expand single-layer CSS mask shorthands #501 / closes Expand CSS mask shorthands into retained longhands #499 — mask property identity, aliases, and single-layer shorthand expansion.
2. Consumer: this PR / closes Render URL-backed SVG masks in retained scenes #500 — URL-backed SVG retained resources and backend projection.

This PR is based on feature/css-mask-shorthand-499. Merge #501 first, retarget this PR to main, then merge this PR.

Validation

git diff --check passed. Native retained-scene and Skia backend regressions were authored but not executed. Provider tip is abf311e5f237c4718c2a785c9ab76f682bc2bfda; this consumer tip is b75b7769bf05c1e3ce8579fc3b6f991224e60d77. Automatically started workflows were canceled to conserve the queue. Builds, browser/native/WPT, pixels, performance, memory, package, and broad CI validation remain deferred under the current throughput directive and are recorded in #500, #256, and #235.

Closes #500