refactor(app): cut liboakengine, link module rlibs directly (M14 R3)

- real.rs rewritten over module Rust APIs (Arc<Mutex<Project>> +
  NodeId; the addref handle dance and renderer boxes are gone);
  AppEngine trait and all panels untouched
- new app assembly layers: graphops (project/timeline/edit
  primitives), effectchain (chain composition with undo groups),
  renderops (montage build + ticket render + ExportTask export),
  library via oakstorage directly
- module-side safe API additions: oakundo global value-semantic
  push/undo/redo + from_closures, oakstorage project_arc_of
- deleted: src/oakui/ffi.rs, src/oakui/host_syms.rs, the dylib link
  config in build.rs (only the gpui IOSurface framework link remains)
- the binary carries zero liboakengine references (otool/nm verified);
  101 app tests green incl. the real-render and full-res e2e tests
- behavior improvements for free: sequences land in the project graph
  (the facade scratch-project deviation is gone), footage drops take
  one undo record, effect remove/reorder undo restores edges

crates/oakengine/src/undo.rs

@@ -103,7 +103,9 @@ pub unsafe extern "C" fn oakengine_undo_push(command: *mut c_void, name: *const
 /// `oakengine_undo_group_begin` — start collecting commands into a group.
 #[no_mangle]
 pub extern "C" fn oakengine_undo_group_begin(name: *const c_char) -> c_int {
-	guard(|| oakundo::global::group_begin(name).map_err(map_group_err))
+	guard(|| unsafe {
+		oakundo::global::group_begin(&crate::handle::read_cstr(name)).map_err(map_group_err)
+	})
 }
 
 /// `oakengine_undo_group_end` — close the group and push it as one entry.