Deleting a window's WM_CLASS emits set_class with class==NULL while the
title is set; handle_xs_set_class passed the raw NULLs into
wlr_foreign_toplevel_handle_v1_set_app_id / ext update_state, which
strdup(NULL) -> SIGSEGV (exit 139; UBSan flags the nonnull argument
first). The sibling set_title handler and every other mirror site use
foreign_str(); apply the same guard here.
Add tests/xclass.c (title set, WM_CLASS set-then-deleted probe) and a
headless smoke test asserting the compositor survives the delete with
no crash indicators (fails pre-fix: compositor dead).
