[SimonCropp]

A viewer that owns the inline queue holds it in memory and stages it on the way out, but a Linux logoff never gets that far:

• The X server goes first, and Xlib then ends the process with exit(1).
• systemd sends SIGTERM and SIGHUP, and .NET ends the process on either with no finally run.

Either way the snapshots were lost. Windows already staged them, through HeadForm.SessionEnding.

This moves to PlatformHeads 0.6.0 (SimonCropp/PlatformHeads#3), which hears both:

• ViewerProgram.SessionEnding marks the session closing and stages the queue. It runs once and touches no window, so it's safe on a signal's thread or inside a call into the window. A display lost during a mutation can't mark the session closing, but the queue is still staged.
• NativeViewerWindow implements ILoopHooks and passes SessionEnding to the new deview_on_display_lost. The Linux shim hands it to ph::OnDisplayLost. The macOS shim exports it and never calls it, because a logout there is the app's own quit.
• ViewerProgram holds a SessionEndSignals for SIGTERM and SIGHUP. Signals don't save the placement, since they arrive on a thread of their own. The Windows hook still saves it after staging.
• DEVIEW_VERSION goes to 13 for the new entry point, and all six PlatformHeads pins move to 0.6.0.

Checked in an ubuntu:24.04 container by building the shim at 0.6.0, then running the viewer under Xvfb, launched with an inline payload for a temporary project:

• Killing Xvfb: the trio was staged in obj/VerifyInline, then Xlib exited with code 1.
• SIGTERM, then SIGHUP at once: the trio was staged, and the exit code was 129.

ViewerProgramTests checks that SessionEnding stages the queue, does so from inside a mutation, and stages it only once.

The committed binaries are still version 12, so the native jobs fail until the binaries PR that build-native opens is merged into this branch.