OpenXrRenderLoop::stage_parameters_id_ uninit-read POC

Requests an immersive WebXR session backed by OpenXR without the bounded-floor reference space, so OpenXrApiWrapper::GetStageParameters() returns false and SetStageParameters(nullptr) early-returns without ever writing stage_parameters_id_. The first XRFrameData then carries the uninitialized 4 bytes back to the renderer.

The leaked value is not WebIDL-exposed; apply renderer-injection.patch (or otherwise compromise the renderer) to observe it. The patched renderer prints the raw value to stderr/logcat as POC-LEAK.