feat(oakrender): render-process isolation S1 - dispatcher, scheduler, real worker

Per the M15 design (docs/zh/plans/riir/M15-render-process-isolation.md):

- ipc.rs moved into oakrender with protocol v2: hello_caps,
  render_batch, batch_accepted, frame_failed; main-process-assigned
  slots; BGRA8 slot format. POSIX shm verified to 1GiB on macOS.
- ProcessDispatcher: spawns oak-worker processes, handshake, stdio
  NDJSON control, shm segment lifecycle with generation-tagged keys,
  crash detection with bounded restart and frame redispatch, zero-copy
  ShmFrameRef delivery and copy counters.
- PreviewScheduler: interleaved batch claiming (frame % W per worker,
  no work stealing), seek > playback-distance > background priority,
  credit-based flow control, crash recovery.
- oak-worker renders for real: graph snapshot deserialization, montage
  decode+composite straight into the assigned shm slot, F32->BGRA8
  final conversion in-worker, OFX plugin executor installed in-worker,
  crash hooks for isolation testing.

Thread pool coexists for now (S2 removes it). Integration tests cover
two-worker zero-copy rendering, crash isolation with redelivery, and
real H.264 footage decode into slots.

Cargo.lock

@@ -4775,6 +4775,9 @@ name = "oak-worker"
 version = "0.1.0"
 dependencies = [
  "libc",
+ "oakcore-rs",
+ "oaknode",
+ "oakplugin",
  "oakrender",
  "serde",
  "serde_json",
@@ -4886,11 +4889,14 @@ dependencies = [
 name = "oakrender"
 version = "0.1.0"
 dependencies = [
+ "libc",
  "oakcodec",
  "oakcommon",
  "oakcore-rs",
  "oaknode",
  "ocio-rs",
+ "serde",
+ "serde_json",
  "thiserror 2.0.20",
  "wgpu 25.0.2",
 ]