fix(shell): distinguish between unmapping and destroying surfaces

Previously, `unmap_surface` automatically pushed all unmapped windows
into the `pending_windows` list. This behavior is correct for X11
windows (which may be remapped) but incorrect for Wayland `toplevel_destroyed`
events, where the role is permanently gone.

This caused issues with clients like Telegram that reuse `wl_surface`s.
Because the destroyed toplevel remained in `pending_windows`, a
subsequent cleanup commit (e.g., null buffer) triggered a configure
event. This prematurely marked the surface as `configured` in the
shell state.

Consequently, when the client attached a new `xdg_toplevel` role,
the compositor skipped the mandatory initial configure event (assuming
it was already done), causing the window to never appear.

This refactors `unmap_surface` to return `Option<PendingWindow>`
instead of mutating global state.
- XWayland: Explicitly saves the pending window (behavior preserved).
- XDG Shell: Drops the pending window, preventing ghost state interactions.

Fixes #1816

src/shell/mod.rs

@@ -2832,7 +2832,8 @@ impl Shell {
         surface: &S,
         seat: &Seat<State>,
         toplevel_info: &mut ToplevelInfoState<State, CosmicSurface>,
-    ) where
+    ) -> Option<PendingWindow>
+    where
         CosmicSurface: PartialEq<S>,
     {
         for set in self.workspaces.sets.values_mut() {
@@ -2890,15 +2891,16 @@ impl Shell {
 
             if let Some(surface) = surface {
                 toplevel_info.remove_toplevel(&surface);
-                self.pending_windows.push(PendingWindow {
+                return Some(PendingWindow {
                     surface,
                     seat: seat.clone(),
                     fullscreen: None,
                     maximized: false,
                 });
-                return;
             }
         }
+
+        None
     }
 
     pub fn move_current(