Settle leases, styles, credits and controls in the renderer contract

- claimPointer takes a grab filter, asked on each down: a lease takes
  only the presses it grabs, and wheel, pinch and every other press stay
  with the camera and everyone else. Each event of a press goes where its
  down went, per button, so a claim never takes a press under way.
- Core owns the styles: effects.defineStyle passes a GLSL (and optionally
  WGSL) full-screen pass, with the shader interface written out.
- Credits are plain data ({ text, href, logoUrl, inline }) that Core
  renders; CreateOptions.creditContainer goes.
- controls.coast { drag, zoom } in seconds replaces the inertia trio; the
  stub's defaults are the default renderer's, converted.
- The frame order is the default renderer's own: a move made by follow or
  in preUpdate reaches changed on the next frame.

docs/RENDERER-CONTRACT.md

@@ -53,7 +53,11 @@ The rules that hold everywhere:
   listeners, and the frame, still run.
 - **The frame order is fixed:** camera flight → input → camera `changed` →
   follow → `preUpdate` → move detection → `preRender` → render →
-  `postRender`.
+  `postRender`, the default renderer's own. A camera move made by follow or
+  in `preUpdate` is reported by `changed` on the next frame.
+- **Leases:** a tool takes the pointer with `claimPointer`. With `grab`, it
+  takes only the presses it grabs on `down`; the rest, and wheel and pinch,
+  stay with the camera and everyone else.
 
 `src/render/contract/index.js` lists every member of every port in `PORTS`,
 along with `CAPABILITIES`, `FRAME_STEPS` and `QUALITY_KEYS`.