docs: refresh DisplayGfx slot 0 docstring after the destructor port

Updates the slot 0 entry in `DisplayGfxVtable` to point at the new
Rust impl `display::destructor::display_gfx_destructor`, document
the trapped helpers, and switch the typed `flags` parameter from
`u8` to `u32` so it matches the actual Rust impl signature (the
underlying x86 stack slot is 4 bytes either way, but `u32` is more
honest about what the function reads).

The project memory (`MEMORY.md` + `project_display_porting.md`) is
updated separately to reflect that the display *frontend* is now
100% Rust including shutdown teardown, and to record three new
lessons from the port:

35. Ghidra plate comments can fabricate semantics the disasm
contradicts (the "rebind to DDDisplay parent vtable"
annotation was actually rebinding to the most-derived
DisplayGfx vtable).
36. Vestigial vtable slots in .rdata are normal — DisplayGfx
slots 38/39 exist but are never dispatched, which is what
let us trap TileBitmapSet::Destructor.
37. The startup-check VALID_PROLOGUES list isn't just frame
setups — `F6` (TEST [mem], imm8) is a legitimate function
start byte for thunks that check a flag without setting up
a frame.

crates/openwa-core/src/render/display/vtable.rs

@@ -47,9 +47,20 @@ use crate::wa_alloc::wa_malloc_struct_zeroed;
 /// - Methods that add `camera` directly take pixel-integer coordinates.
 #[vtable(size = 38, va = 0x0066_A218, class = "DisplayGfx")]
 pub struct DisplayGfxVtable {
-    /// destructor (0x569CE0, RET 0x4)
+    /// scalar deleting destructor (original at 0x569CE0, RET 0x4).
+    ///
+    /// **Ported.** Native Rust impl is
+    /// [`crate::render::display::destructor::display_gfx_destructor`].
+    /// The thunk runs the cleanup body (`DestructorImpl`, originally
+    /// 0x56A010) and then `_free(this)` if `flags & 1` is set, returning
+    /// `this` per the MSVC ABI. Wired via `vtable_replace!` in
+    /// `install_display`. The three WA-side helpers
+    /// (`DestructorImpl`, `FreeLayerSpriteTable`,
+    /// `TileBitmapSet::Destructor`) are trapped — see commit 5 of the
+    /// destructor port for the dead-slot analysis behind trapping the
+    /// `TileBitmapSet` helper.
     #[slot(0)]
-    pub destructor: fn(this: *mut DisplayGfx, flags: u8) -> *mut DisplayGfx,
+    pub destructor: fn(this: *mut DisplayGfx, flags: u32) -> *mut DisplayGfx,
     /// get display dimensions in pixels (0x56A460, RET 0x8)
     #[slot(1)]
     pub get_dimensions: fn(this: *mut DisplayGfx, out_w: *mut u32, out_h: *mut u32),