feat(oakrender): render-process isolation S1 - dispatcher, scheduler, real worker

Per the M15 design (docs/zh/plans/riir/M15-render-process-isolation.md):

- ipc.rs moved into oakrender with protocol v2: hello_caps,
  render_batch, batch_accepted, frame_failed; main-process-assigned
  slots; BGRA8 slot format. POSIX shm verified to 1GiB on macOS.
- ProcessDispatcher: spawns oak-worker processes, handshake, stdio
  NDJSON control, shm segment lifecycle with generation-tagged keys,
  crash detection with bounded restart and frame redispatch, zero-copy
  ShmFrameRef delivery and copy counters.
- PreviewScheduler: interleaved batch claiming (frame % W per worker,
  no work stealing), seek > playback-distance > background priority,
  credit-based flow control, crash recovery.
- oak-worker renders for real: graph snapshot deserialization, montage
  decode+composite straight into the assigned shm slot, F32->BGRA8
  final conversion in-worker, OFX plugin executor installed in-worker,
  crash hooks for isolation testing.

Thread pool coexists for now (S2 removes it). Integration tests cover
two-worker zero-copy rendering, crash isolation with redelivery, and
real H.264 footage decode into slots.

crates/oakrender/tests/copier_test.rs

@@ -47,7 +47,10 @@ fn frame_producer() -> oakrender::ticket::Producer {
 fn cacher() -> (oakrender::autocacher::PreviewAutoCacher, WorkerPool) {
 	let mut pool = WorkerPool::new(2);
 	pool.start();
-	let arena = Arc::new(TicketArena::new(pool.clone(), frame_producer()));
+	let arena = Arc::new(TicketArena::new(
+		Arc::new(pool.clone()),
+		frame_producer(),
+	));
 	(oakrender::autocacher::PreviewAutoCacher::new(arena), pool)
 }