fix(replay): Avoid windowLocation race and bitmap leak in SurfaceView capture

Address two issues flagged by review:

1. windowLocation race — root.getLocationOnScreen(windowLocation) ran on the
   main thread, but compositeSurfaceViewsAndMask read windowLocation[0]/[1]
   later from the executor thread. If a new capture cycle started before the
   compositor ran, the field was overwritten and SurfaceView pixels would
   composite at the wrong offset. Snapshot into locals (windowX/windowY) at
   capture time and pass them through, matching the existing svLocation →
   capturedX/capturedY pattern.

2. Bitmap leak when isClosed in SurfaceView callback — when the strategy
   closed mid-capture, the path recycled the in-flight svBitmap but skipped
   onCaptureComplete(), so remaining never reached zero and any sibling
   bitmaps already stored in captures[] leaked until GC. Now still drive the
   completion latch on the closed path, and have the compositor's
   early-return path recycle leftover captures.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: romtsn

sentry-android-replay/src/main/java/io/sentry/android/replay/screenshot/PixelCopyStrategy.kt

@@ -157,14 +157,18 @@ internal class PixelCopyStrategy(
     surfaceViewNodes: List<ViewHierarchyNode.SurfaceViewHierarchyNode>,
     viewHierarchy: ViewHierarchyNode,
   ) {
+    // Snapshot the window location into locals so the executor-side compositor reads stable
+    // values even if a new capture cycle starts and overwrites the field.
     root.getLocationOnScreen(windowLocation)
+    val windowX = windowLocation[0]
+    val windowY = windowLocation[1]
 
     val captures = arrayOfNulls<SurfaceViewCapture>(surfaceViewNodes.size)
     val remaining = AtomicInteger(surfaceViewNodes.size)
 
     fun onCaptureComplete() {
       if (remaining.decrementAndGet() == 0) {
-        compositeSurfaceViewsAndMask(root, captures, viewHierarchy)
+        compositeSurfaceViewsAndMask(root, captures, viewHierarchy, windowX, windowY)
       }
     }
 
@@ -191,6 +195,9 @@ internal class PixelCopyStrategy(
           { copyResult: Int ->
             if (isClosed.get()) {
               svBitmap.recycle()
+              // still drive the completion latch so any prior captures get recycled by the
+              // composite step's early-return path.
+              onCaptureComplete()
               return@request
             }
             if (copyResult == PixelCopy.SUCCESS) {
@@ -214,11 +221,14 @@ internal class PixelCopyStrategy(
     root: View,
     captures: Array<SurfaceViewCapture?>,
     viewHierarchy: ViewHierarchyNode,
+    windowX: Int,
+    windowY: Int,
   ) {
     executor.submit(
       ReplayRunnable("screenshot_recorder.composite") {
         if (isClosed.get() || screenshot.isRecycled) {
           options.logger.log(DEBUG, "PixelCopyStrategy is closed, skipping compositing")
+          recycleCaptures(captures)
           return@ReplayRunnable
         }
 
@@ -234,8 +244,8 @@ internal class PixelCopyStrategy(
             capture.bitmap,
             capture.x,
             capture.y,
-            windowLocation[0],
-            windowLocation[1],
+            windowX,
+            windowY,
             config.scaleFactorX,
             config.scaleFactorY,
           )
@@ -247,6 +257,14 @@ internal class PixelCopyStrategy(
     )
   }
 
+  private fun recycleCaptures(captures: Array<SurfaceViewCapture?>) {
+    for (capture in captures) {
+      if (capture != null && !capture.bitmap.isRecycled) {
+        capture.bitmap.recycle()
+      }
+    }
+  }
+
   override fun onContentChanged() {
     contentChanged.set(true)
   }