Build conservative allocation-free world occlusion culling for PRK.Client

Outcome: add high-quality geometry occlusion culling for large outdoor PRK.Client scenes, retaining existing camera/spatial culling and preserving rendering correctness. User requires a modern architecture, fast culling and no runtime allocations in the culling hot path. Source-confirmed architecture constraints (develop at 83ad94135; clean working tree): - SceneCuller/CullEntryTable/StaticCullGrid already provide cached world bounds, stable slots, change journals, a two-level static grid and candidate bitsets. Ordinary scenery has a 100 m near-frustum exemption; this must not become an occlusion exemption. - InstanceBuilder builds CPU InstanceBatchTable/DrawStreamBuilder and uploads all admitted instance rows before recording. DrawStreamRecorder and Mesh.RecordVulkan issue direct indexed draws using separate per-mesh vertex/index buffers. GPU visibility alone will not eliminate CPU lighting, stream construction or draw-recording work. - Main view, water reflection, sky probe and world/body shadow consumers reuse scene data. Main-view occlusion must be per-view/per-pass, never delete shared candidate or caster data. Animated bodies have a separate rendering path. - DepthConvention is reverse-Z (near 1, far/clear 0): conservative raw-depth hierarchy uses MIN, not MAX. Existing AO pyramid uses filtered linear depth and thin-surface sign metadata; it is not a valid occlusion hierarchy. AO's existing full-resolution geometry prepass is a possible shared depth producer, but AO on/off must remain independent. - Mesh drops CPU vertices/indices after GPU upload; software rasterization would need an explicit new geometry ownership/storage design. Vulkan enabled features currently do not include multiDrawIndirect/drawIndirectFirstInstance; capability negotiation and fallback are implementation work. Proposed direction: CPU spatial/frustum broad phase -> actual opaque terrain/building depth in the current camera -> conservative reverse-Z Hi-Z -> GPU instance visibility and indirect output. Prefer current-frame proof for rejection; history may prioritize occluder rendering but is never sufficient by itself to discard geometry. First delivery targets static terrain/world geometry; preserve existing behavior for unsupported shaders and other passes. Reuse renderer/frame-slot retirement, allocator, compute and profiling infrastructure. Avoid per-object hardware queries, CPU depth readback, corner-ray tests and bounding boxes used as solid occluders. A full GPU-driven renderer/shared mesh arena is a separate major refactor and should only follow demonstrated CPU submission cost, not be introduced speculatively. Required correctness: camera-inside/near-plane-intersecting or unprojectable bounds fail open; round projected rectangles outward; compare nearest object depth to the farthest covered occluder depth conservatively; every covered footprint must be accounted for, including odd image sizes and clear/sky holes. Use real depth-writing triangles with matching deformation, culling and alpha coverage; never fill door/window holes with proxy bounds. Keep blending order, picking, reflections and off-camera shadow casters correct. No stale-depth popping during rapid camera movement, teleport, door changes or streaming. Allocation contract: reserve CPU/GPU capacity at initialization or explicit scene/streaming admission, not inside visibility traversal/dispatch/recording. Reuse per-frame-slot scratch, descriptors, result and indirect buffers. Bounded capacity exhaustion renders excess candidates normally, with a diagnostic counter, rather than allocating, stalling or dropping geometry. This contract concerns the new visibility path; existing unrelated renderer allocations must not be claimed fixed. Scene/resource creation inherently needs an explicit allocation phase. Acceptance: real Vulkan regression scenes compare enabled/disabled color/depth/picking and verify hidden instances actually stop drawing; preserve shadow/reflection output and immediate disocclusion. Verify culling hot-path managed allocation count after capacity reservation and assert no per-frame Vulkan resource creation. Cover frame-slot reuse, resizing, streaming and capacity overflow. Report CPU/GPU culling costs, eliminated instances/triangles/draws, memory and total-frame median/p95 against matched control runs in open, terrain-occluded and building-heavy scenes. No performance gain claimed before matched measurements; no tests or benchmarks have run for this work yet. Current milestone: repository reconnaissance and architecture proposal only; no code changes, implementation or benchmark result yet. Outstanding design refinement: choose a measured depth-producer strategy (selected opaque occluders versus existing full AO geometry prepass) without duplicating expensive work; pin down per-view instance indirection and portable indirect-draw integration before editing.