Harden hook removal: disable -> drain -> destroy, and drain settles first

Uncapping the mock game (next commit) turned mock_game_test's hook/unhook storm
into a real stress test (thousands of presents/s instead of tens), which reliably
crashed the game on remove (0xC0000005) for dx9/dx11/dx12. Two races the slow
vsync'd mock had masked:

1. Trampoline use-after-free. remove_*_hooks did `hook = {}` (destroy) BEFORE the
   DetourGate drain. Destroying a SafetyHook InlineHook frees its trampoline
   immediately, but an in-flight detour about to call the original via .stdcall()
   (the trampoline) then used freed memory. Fix: disable() first (restores the
   original bytes under thread suspension, but KEEPS the trampoline alive) -> drain
   -> only then destroy. Applied to present/d3d9/opengl/vk/xinput/mkb/focus.

2. Entry-window race in DetourGate::drain(). It returned the instant the active
   count read zero, but a thread can be inside the detour yet not have reached its
   Guard constructor (the prologue is unguarded), so the count reads zero while a
   detour is about to run -- and the freed state is then used. Fix: Sleep(1) BEFORE
   each zero-check; with the hook disabled no new detour starts, so any
   already-entered thread registers within that window. This alone fixed dx11 (the
   highest present rate, ~11000/s, which hit the window every storm).

Audio is unaffected (it uses vtable swaps, which keep a real original pointer, not
a trampoline). Full suite 21/21, and the storm now survives on every backend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hook/src/d3d9_hook.cpp

@@ -366,11 +366,15 @@ bool install_d3d9_hooks(IpcClient& ipc)
 
 void remove_d3d9_hooks()
 {
-	// Reset the hook first (restores Present's bytes under thread suspension -> no new detour),
-	// then drain any Present detour still in-flight before freeing the D3D state it reads (UAF).
-	g_hk_present9 = {};
+	// DISABLE (not destroy) first: restores Present's bytes under thread suspension (no new detour)
+	// but keeps the trampoline alive, so an in-flight detour about to call g_hk_present9.stdcall()
+	// (the trampoline) doesn't have it freed under it. Destroying (= {}) before the drain frees the
+	// trampoline immediately -- a UAF the uncapped mock-game storm (thousands of presents/s) hits
+	// reliably (0xC0000005). Disable -> drain -> only then destroy.
+	(void)g_hk_present9.disable();
 	hook_set_installed(g_id_present9, false);
 	g_gate.drain();
+	g_hk_present9 = {}; // no detour in-flight or able to start now -> safe to free the trampoline
 	release_shared();
 	release_sysmem();
 	if (g_ctx != nullptr)