Make QuadSurface::gen() safe for concurrent rendering

[robert-kofler42]

Problem

The renderer (Render.cpp, vc_render_tifxyz) calls QuadSurface::gen() from OpenMP tile workers on a single surface instance. gen() wrote into shared mutable scratch members (_genCoordsScratch/_genNormalsScratch/_genValidScratch) and lazily built shared caches (_normalCache, _validMaskCache) with no synchronization. Concurrently this corrupts output and can crash — one thread's cv::Mat::create() reallocates a buffer another thread is mid-read. This is the vc-render-tifxyz SIGSEGV in #1046, and the thread-safety gap tracked in #1054.

Closes #1054. Closes #1046 (same root cause — backtrace points at the _normalCache warp in gen(); see analysis on that issue).

Fix

• Scratch buffers → thread_local. Each worker reuses its own coords/normals/validity buffer across frames, keeping the per-frame allocation-reuse optimization without cross-thread sharing.
• Lazy caches serialized with a new _cacheMutex. validMask() takes the lock for the whole accessor and returns a header copy made under it. _normalCache is built and snapshotted under the lock; the expensive warp then runs lock-free on the snapshot.
  • The snapshot is the crucial part: plain double-checked locking is not enough, because cv::Mat::create() marks the Mat non-empty before it is filled — so a second thread on the cache-hit path would warp a half-built cache (silent wrong normals, no crash).
  • Every cache-clear site (unloadPoints, unloadCaches, invalidateCache, invalidateMask) takes the same lock. Lock ordering is always _loadMutex -> _cacheMutex.

No numeric change: outputs are bit-identical to the serial path.

Test

Adds test_quadsurface_gen_concurrency: runs many gen() calls concurrently on one surface and checks each result matches a serial reference bit-for-bit.

• Unfixed: fails 20/20 (corrupted output).
• Fixed: passes 40/40 stress runs, and clean under ThreadSanitizer.

ThreadSanitizer note: with -DVC_ENABLE_TSAN=ON the only remaining warnings are inside validMask()'s internal #pragma omp parallel for reduction — a known GCC libgomp false positive (libgomp barriers aren't modeled by TSAN without the archer runtime). Suppress with race:libgomp.so / called_from_lib:libgomp.so.

cmake -B build -DCMAKE_BUILD_TYPE=RelWithDebInfo -DVC_TESTING=ON
cmake --build build --target test_quadsurface_gen_concurrency -j
ctest --test-dir build -R test_quadsurface_gen_concurrency --output-on-failure

[vercel]

Someone is attempting to deploy a commit to the scroll Team on Vercel.

A member of the Team first needs to authorize it.