Stratified sampling and batched raster points in the native core (ABI v10)

[Alek99]

Moves two Python hot paths into the Rust core, per the offload review of the remaining compute in the payload/LOD/export paths.

Stratified sampling (fc_stratified_sample_mask, ABI v9 → v10)

lod.stratified_sample_keep_mask — the category-aware mask behind categorical density overlays — previously ran a per-category NumPy loop whose inverse == group rescans made it O(n · categories), on every categorical density build/zoom. It is now one fused native pass: per-category counts, sqrt-scaled hash thresholds, and the lowest-hash min_per_category floor (parallelized like sample_mask, with a bounded fallback for degenerate groupings). Small non-negative integer categories — the channel-codes hot path — skip np.unique entirely and serve directly as group codes.

• Bit-identical masks: parity-tested against the NumPy reference on both sides of the ABI (Rust test vs a ported oracle; Python test vs the old loop). Exactness holds because SplitMix64 is a bijection, so distinct ids cannot tie; duplicate-id ties break deterministically toward the lower row index.
• Measured: 168 ms → 8.5 ms (~20×) at 5M rows / 12 categories (Apple Silicon dev box).

Batched scatter marks in the PNG display list (OP_POINTS)

Native PNG export built its display list with a per-point Python loop (struct.pack per mark, plus a per-point css_check re-parse for categorical palettes). Scatter marks now ship as one struct-of-arrays command — NumPy-packed coordinate/radius/fill columns plus a shared symbol/stroke header — and the Rust side loops the existing SDF point painter. Palette entries resolve once into a lookup table.

• Pixel-identical to per-mark OP_POINT (Rust parity test across symbols and strokes). Non-finite marks are skipped defensively (NaN would poison the framebuffer via NaN-vs-clip comparisons); truncated buffers are rejected like every other opcode.
• Measured: display-list build for a 100k-point categorical scatter drops ~186 ms → ~1 ms; command buffer shrinks ~40% (2.6 MB → 1.6 MB).

Bar/rect emit loops stay in Python — they scale with categories, not points.

Housekeeping

• ABI_VERSION bumped to 10 in both authoritative locations (src/lib.rs, _native.py).
• scripts/abi_smoke.py covers the new entry point (70 checks).
• examples/demo.ipynb reformatted — it was failing the ruff format gate on main and blocked make check-full.
• CHANGELOG entries under Unreleased.

Verification

make check-full passes locally (13 checks: floor, public API, claims, CI workflows, ruff lint+format, ty, pytest 883, js bundle, cargo test 59, clippy -D warnings, release build, ABI smoke). Browser smokes and wheel/sdist verification are left to CI per the production-readiness doc.