fix: deep-review round — legacy-ABI export, threading, and Vulkan robustness

- ovrp_GetTimeInSeconds: real export returning double (legacy direct-return
  ABI); the autogen ovrpResult stub left d0 uninitialized and the game reads it
- seqlock writer: fence the odd-mark before the data stores (torn-pose window)
- drain the frameState ring on STOPPING/shutdown (stale displayTime + permanent
  one-frame skew after every session pause)
- begin_frame FIFO bail: bound the wait (surface-teardown deadlock) and measure
  the deadline on CLOCK_MONOTONIC, immune to wall-clock steps
- passthru: pthread_once takeover + acquire/release PT_FWD pointer cache
  (first-use race could run the shim path mid-takeover)
- luma/dump/barcode readback disabled for non-4-byte swapchain formats
  (staging buffers assumed 4 B/texel; wider fallback formats would overflow)
- vkWaitForFences: honor timeouts everywhere; never reset a pending cmd buffer
- detect_ue_queue: keep the caller's queue family/index when detection fails
- xrr_get_node_pose: g_spaceLock vs the sitting/standing appSpace recreate
  (locate on a freed XrSpace)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

shim/README.md

@@ -47,6 +47,13 @@ Session lifecycle, frame loop (xrWaitFrame/Begin/EndFrame), poses (xrLocateViews
 Space), swapchains (xrCreateSwapchain from ovrpLayerDesc, acquire/wait/release,
 XrCompositionLayerProjection submit). Vulkan binding from Initialize5 args [VERIFIED].
 
+## Debug: passthru forwarding (author-only diagnostic)
+`debug.re4vr.passthru=1` makes the shim hand the whole OVRPlugin session to a real,
+SONAME-patched `libOVRPlugin_real.so` if one is present in the APK — an A/B harness for
+diffing native runtime behavior against the shim. **No such binary is included or
+distributed by this repo**; you would have to place one from your own device dump, and
+without it the flag is inert. All other `debug.re4vr.*` props are likewise diagnostics.
+
 ## Next (see ../TESTING.md for the test plan)
 1. NDK arm64 build (host build is validation only).
 2. [ANDROID-TODO] JavaVM/activity -> XrInstanceCreateInfoAndroidKHR + xrInitializeLoaderKHR.