fix(surface): handle nil WritePixels receiver

[besmpl]

Summary

• return ErrReleased when WritePixels is called on a nil *Surface
• match the nil-receiver behavior added for ReadPixels in feat(software): expose headless surface readback #276
• add a focused regression proving the call returns an error instead of panicking

This addresses the sole non-blocking follow-up noted during review of #276. It does not change the behavior of configured, released, or unsupported surfaces.

Validation

Passed locally with CGO_ENABLED=0 and GOWORK=off:

• go test -count=1 . -run '^TestSurfaceWritePixelsNil$'
• go test -count=1 ./hal/software ./core .
• go test -count=1 ./...
• go test -race -count=1 .
• go test -count=1 -tags rust ./...
• default and Rust-tagged builds
• browser WASM root build
• Android arm64 full build
• golangci-lint v2.12.2 run --timeout=5m --new-from-rev=upstream/main ./...
• gofmt and git diff --check

Follow-up to #276.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[kolkov]

Exactly the follow-up from our #276 review. s == nil guard now matches ReadPixels. Test covers the nil-receiver panic path. LGTM.