Document Metal executor drop order

src/engine/metal.rs

@@ -558,6 +558,11 @@ impl Session {
     }
 }
 
+// SAFETY: declaration order is required because Rust drops fields in order.
+// `session` must release every Buffer before `_context` calls ds4_gpu_cleanup(),
+// and `_context` must drop before `model` unmaps memory wrapped without copying
+// by native/metal/ds4_metal.m:10329. This intentionally differs from
+// ../ds4/ds4.c:56287-56288; do not reorder these fields to match it.
 pub(super) struct Executor {
     weights: Weights,
     session: Session,