feat(oakrender): render-process isolation S1 - dispatcher, scheduler, real worker

Per the M15 design (docs/zh/plans/riir/M15-render-process-isolation.md):

- ipc.rs moved into oakrender with protocol v2: hello_caps,
  render_batch, batch_accepted, frame_failed; main-process-assigned
  slots; BGRA8 slot format. POSIX shm verified to 1GiB on macOS.
- ProcessDispatcher: spawns oak-worker processes, handshake, stdio
  NDJSON control, shm segment lifecycle with generation-tagged keys,
  crash detection with bounded restart and frame redispatch, zero-copy
  ShmFrameRef delivery and copy counters.
- PreviewScheduler: interleaved batch claiming (frame % W per worker,
  no work stealing), seek > playback-distance > background priority,
  credit-based flow control, crash recovery.
- oak-worker renders for real: graph snapshot deserialization, montage
  decode+composite straight into the assigned shm slot, F32->BGRA8
  final conversion in-worker, OFX plugin executor installed in-worker,
  crash hooks for isolation testing.

Thread pool coexists for now (S2 removes it). Integration tests cover
two-worker zero-copy rendering, crash isolation with redelivery, and
real H.264 footage decode into slots.

crates/oakrender/src/lib.rs

@@ -32,6 +32,9 @@
 //! - `backend` — wgpu GPU context + display renderer
 //! - `copier` — render-side project-copy client (oaknode C ABI)
 //! - `cancelatom` — the cancellation primitive
+//! - `ipc` — render-worker NDJSON protocol + shm frame-slot transport
+//! - `scheduler` — preview frame scheduler (interleaved batch claims)
+//! - `procpool` — process-isolated render backend (M15)
 //! - `bridge` — direct-call C ABI bridges (oakcommon/oaknode/oakcodec)
 //! - `ffi` — the `include/render/*.h` export layer
 
@@ -49,7 +52,10 @@ pub mod error;
 pub mod eval;
 pub mod frame;
 pub mod handle;
+pub mod ipc;
 pub mod manager;
+pub mod procpool;
+pub mod scheduler;
 pub mod texture;
 pub mod ticket;
 pub mod worker;