refactor(ffi-linkage): Phase 6.5 — migrate gpu/ #foreign→extern; library/ now #foreign-free

Final Phase 6 batch: gpu/gles3.sx (eglGetProcAddress + 1 comment) and gpu/metal.sx
(MTLCreateSystemDefaultDevice), bare fn markers → 'extern'. Verified byte-identical
'sx ir' on importers 1610 (gles3 via uikit GLView) + 1606 (metal). **PHASE 6
COMPLETE — zero #foreign remains anywhere under library/.** Empty snapshot diff;
suite green (647 corpus / 444 unit, 0 failed). Next: Phase 7 (examples + issues).

library/modules/gpu/gles3.sx

@@ -2,7 +2,7 @@
 //
 // We use opengl.sx's runtime-loaded function-pointer variables for every
 // GL call, populated via `load_gl(@eglGetProcAddress)` in `init()`.
-// `#foreign` decls for the same names would collide with opengl.sx's
+// `extern` decls for the same names would collide with opengl.sx's
 // global variables and silently win — that produces NULL function-
 // pointer calls (PC=0 crash) because the variables are uninitialized.
 //
@@ -31,7 +31,7 @@
 // the EGL context is current. We declare only the loader here; EGL
 // surface/context creation belongs in the consumer's `#jni_main`
 // Activity (e.g. an `onCreate` body that calls `eglCreateContext`).
-eglGetProcAddress :: (name: [*]u8) -> *void #foreign;
+eglGetProcAddress :: (name: [*]u8) -> *void extern;
 
 
 // Functions absent from opengl.sx (it was authored against the SDL

library/modules/gpu/metal.sx

@@ -18,7 +18,7 @@
 // MTLCreateSystemDefaultDevice lives in the Metal framework as a plain C
 // function. Returns id<MTLDevice> retained +1; we leak it for now since
 // the device lives for the whole process.
-MTLCreateSystemDefaultDevice :: () -> *void #foreign;
+MTLCreateSystemDefaultDevice :: () -> *void extern;
 
 // Pixel formats.
 MTL_PIXEL_FORMAT_BGRA8_UNORM :u64: 80;