screenshot: guard against double _ungrab in area/color/window pickers

[rumours86]

The bug. A second BUTTON_RELEASE (or BUTTON_PRESS for SelectWindow) arriving within the 100ms fade-out animation schedules a second _ungrab(), so Main.popModal() runs twice for the same actor. The second call takes the incorrect pop error path in main.js, which first tears down the stage input mode and the X grab and only then throws — the exception aborts _ungrab() before this._group.destroy(), so the fullscreen selection overlay stays on screen: clicks land on the overlay and the panel appears frozen until the shell is restarted.

Reproduce. Take an area screenshot and click once more right after releasing the selection, e.g.:

gdbus call -e -d org.gnome.Shell.Screenshot -o /org/gnome/Shell/Screenshot -m org.gnome.Shell.Screenshot.SelectArea &
sleep 1.2
xdotool mousemove 400 400 mousedown 1 mousemove 700 600 mouseup 1 click 1

Watch ~/.xsession-errors for JS ERROR: Error: incorrect pop from screenshot.js — one affected user had six occurrences in two days of normal use.

The fix. Finish the selection on the first release only, ignore extra input during the fade-out, and make _ungrab() idempotent in all three pickers (SelectArea, PickColor, SelectWindow).

Verified on Cinnamon 6.6.9 (Mint 22.3): normal area selection still returns the same geometry; the reproducer above no longer throws (3 runs), overlay is destroyed properly.

🤖 Generated with Claude Code

[rumours86]

Amended: the _ungrab() guard is now a one-shot this._ungrabbed flag instead of checking this.active — Escape legitimately calls _ungrab() before any selection has started (while active is still false), and the previous version of this PR would have blocked that path, leaving the overlay stuck. Verified both paths live: Escape before selecting and a normal selection both tear the overlay down cleanly; the double-release reproducer still passes.