wayland: do all surface unmap and roundtrips before waiting for pre-apply damage

The pre-apply damage thread may be running when we destroy a terminal
instance, and we need to wait for it to finish before destroying the
underlying buffer.

c291194a4e did this, but failed to
realize the thread may get re-started in the roundtrips done later in
wayl_win_destroy(); after the wait added in
c291194a4e, we unmap all
surfaces (including the main grid), and roundtrip. This means the
compositor will release the currently active buffer, and that means
_we_ will trigger the pre-apply damage thread on it. This introduces a
race, where wayl_win_destroy() may reach its shm_purge() calls before
the pre-apply damage thread has finished. That typically causes foot
to crash.

Closes #2288

CHANGELOG.md

@@ -77,8 +77,11 @@
 
 * Wrong documented default value for `initial-color-theme` in
   `foot.ini(5)` ([#2292][2292]).
+* Occasional crashes when closing a window and
+  `tweak.pre-apply-damage=yes` (the default) ([#2288][2288]).
 
 [2292]: https://codeberg.org/dnkl/foot/issues/2292
+[2288]: https://codeberg.org/dnkl/foot/issues/2288
 
 
 ### Security

wayland.c

@@ -2177,8 +2177,6 @@ wayl_win_destroy(struct wl_window *win)
 
     struct terminal *term = win->term;
 
-    render_wait_for_preapply_damage(term);
-
     if (win->csd.move_timeout_fd != -1)
         close(win->csd.move_timeout_fd);
 
@@ -2236,6 +2234,8 @@ wayl_win_destroy(struct wl_window *win)
         tll_remove(win->urls, it);
     }
 
+    render_wait_for_preapply_damage(term);
+
     csd_destroy(win);
     wayl_win_subsurface_destroy(&win->search);
     wayl_win_subsurface_destroy(&win->scrollback_indicator);