Measure the native shell on macOS, and fix the probe's byte order and clock window

The shell spike had two defects that made its own output untrustworthy, and
both had to go before macOS could be written up.

Probe.SamplePixel assumed the render target was Bgra8888. It is Rgba8888 on
macOS, so every sampled pixel came back with R and B swapped and #007AFF was
reported as #FF7A00. It now reads RenderTargetBitmap.Format, logs the byte
order once a run, and throws rather than guessing at a format it does not
know. No Linux number changes: the format is Bgra8888 there, which is the
branch the old code already took.

ClockWindow.Measure derived a rate from ticks counted in a fixed 3000 ms
window, so a 500 ms timer scored 5 or 6 ticks purely on whether its last tick
landed before the cutoff. It now timestamps each tick and reports the median
gap over at least 30 gaps, extending the window when a slow clock needs it,
and keeps the count-derived figure on the same line so the two can be
compared. On macOS the 500 ms row goes from 600.46 ms/tick to 501.09.

That artifact was load-bearing: the doc claimed the player's two 500 ms
DispatcherTimers "already tick every 600 ms on the Wayland head today", and
that rested on the Wayland 500 ms row. macOS reproduces the same 600 ms under
the counting Measure while being correct on every other row, so the claim is
withdrawn pending a Wayland re-run rather than left standing with a caveat.

Adds SPIKE_DEFAULT_FAMILY, which names FontManagerOptions.DefaultFamilyName
and composes with SPIKE_FONT_SHAPE=a.

The UI shell section gains macOS throughout: theme variant flips are live at
~90-110 ms with no portal, but the accent is read once at start-up and never
updated - an accent change fires no event at all, and the ColorValuesChanged a
variant change does fire carries the stale value, with AppKit's
controlAccentColor as ground truth. $Default is Helvetica there, so the shape
the doc recommends does not yield the system font, and an unresolvable
DefaultFamilyName kills the process in the first layout pass instead of
falling back. Decorations work as intended and give the composition Linux
cannot. Clock and effect-cost tables gain macOS columns.

No product code changes; acting on the font finding in the player is separate.

Author: chrisuthe