Pimpl Lifecycle Discipline

Implement Widget's pimpl correctly: constructor allocates, destructor destroys exactly once, move steals and nulls the source (double-move-safe: moving twice must not crash), and every operation is safe on an empty (moved-from) instance.