fix(gpu): only blame the backend for a crash that happened early

The crash sentinel is armed before the event loop and disarmed after it
returns, so anything that stops the process without unwinding leaves the
file behind and the next launch skips that backend. A real GPU failure
does that — and so does the user closing the app from Task Manager, an
OOM kill, a power cut, or a panic with nothing to do with graphics.

The cost is not a one-off: the skip is permanent, and each later
abnormal end takes the next backend with it, walking a machine down
dx12 -> vulkan -> gl -> software rasterizer. The user is told their
driver is at fault the whole way.

Seen on this machine: a debug build died once while opening a large
drawing, and every launch afterwards reported "dx12 is not usable on
this GPU" on an Intel Iris Xe. Probing the backends directly showed
dx12 not merely usable but the best of the three
(max_storage_buffers_per_shader_stage 262144, against 59 for Vulkan
and 16 for GL). Clearing the stale sentinel brought dx12 straight back.

The failures this guard was built for kill the process at GPU init or
on the first drawing viewport, which is why arming it at all works. A
run that keeps drawing well past that has already shown the backend is
fine, so it now marks the sentinel `survived=1` after
SENTINEL_PROOF_DELAY, and a sentinel carrying that marker accuses
nobody. An early death still blacklists exactly as before.

Verified both ways on Windows 11 with an Intel Iris Xe: killed after
40s, the next launch still chose dx12; killed after 8s, the next launch
skipped dx12 and fell back to Vulkan.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/main.rs

@@ -203,6 +203,14 @@ fn main() -> iced::Result {
             OpenCADStudio::gpu_backend::arm_sentinel(
                 gpu.backend_value.as_deref().unwrap_or("auto"),
             );
+            // The backend is only a suspect while it is young: a run that
+            // keeps drawing past this mark has proved it works, so a later
+            // end — Task Manager, an OOM kill, a power cut — must not cost
+            // the user that backend at the next launch.
+            std::thread::spawn(|| {
+                std::thread::sleep(OpenCADStudio::gpu_backend::SENTINEL_PROOF_DELAY);
+                OpenCADStudio::gpu_backend::mark_sentinel_survived();
+            });
             let result = app::run();
             OpenCADStudio::gpu_backend::disarm_sentinel();
             result