ANGLE Metal — Cross-Origin URL Leak

Leaks GPU process heap to JavaScript via stale ANGLE texture views. The GPU process composites all tabs — URL strings from other origins appear in its heap and are readable by any WebGL2 page. 8 bench-validated strategies × 2 size configs = 16 persistent pool slots.