fix(S4): close graveyard epoch ordering race; add canvas-clip + stride integration tests

Tag LoadedInstrument with installedAt; process() publishes that field (not a re-read
of reloadGeneration_) so the pruner's displacedAt <= seen bound is airtight. Also fixes
sampleRowHitTest canvas.bottom over-read and adds interleave-stride + canvas-clip tests.

tests/test_editor_geometry.cpp

@@ -172,6 +172,16 @@ static void testSampleRowHitTestMisses() {
     CHECK(sampleRowHitTest(L, rows, L.canvas.left - 1, last.top) == -1);
     // Zero rows -> always -1.
     CHECK(sampleRowHitTest(L, 0, 200, L.canvas.top + 1) == -1);
+    // At or below canvas.bottom -> always -1, even if rowCount would cover that y.
+    // This guards paint<->hit-test agreement: sampleRowRect does not clamp to canvas,
+    // so without this clip a row that extends past canvas.bottom would hit-test but
+    // never be drawn (or vice versa).
+    CHECK(sampleRowHitTest(L, rows, 200, L.canvas.bottom) == -1);
+    // Use a large rowCount so index arithmetic would return a valid row without the
+    // canvas.bottom guard — proving the guard fires independently of rowCount.
+    const int bigRows = 1000;
+    CHECK(sampleRowHitTest(L, bigRows, 200, L.canvas.bottom) == -1);
+    CHECK(sampleRowHitTest(L, bigRows, 200, L.canvas.bottom + 5) == -1);
 }
 
 // The drawn-row <-> hit-test agreement: every pixel inside a row rect must resolve to