ci/cd: NVDEC-capable FFmpeg, GCC16-proof OCIO, system-first OCIO env

- Install ffnvcodec headers everywhere the project FFmpeg is built
  (distro packages on Debian/Ubuntu/Arch/MSYS2, nv-codec-headers from
  source on Fedora) so the FFmpeg build picks up NVDEC/NVENC.
- ocio-sys 0.2.1's vendored yaml-cpp misses <cstdint> and fails on
  GCC >= 16 (measured on GCC 16.2.1); patch the dependency to the
  fixed upstream tree (shaloong/ocio-rs, 933c65dc) until a fixed
  release lands on crates.io.
- New tooling/ocio-env.sh decides the OCIO build env per job: system
  OCIO >= 2.5 when present (static when the package ships
  libOpenColorIO.a, dynamic otherwise), vendored static build as the
  fallback. The Arch package gains an 'opencolorio' dependency only
  when the binaries link the system OCIO (build-pkg.sh probes ldd).
- CI 'Build' steps switch from cargo build to cargo check: the Test
  step links the test binaries anyway, and a full build would codegen
  every workspace crate twice.

tooling/package/PKGBUILD

@@ -16,7 +16,9 @@
 
 # Arch package build. The release binaries are built by the caller
 # (tooling/package/build-pkg.sh) before makepkg runs; depends lists the
-# base-OS packages the binaries link (FFmpeg/OCIO are statically linked).
+# base-OS packages the binaries link (FFmpeg is statically linked; OCIO is
+# static when built from the vendored source, and build-pkg.sh appends
+# 'opencolorio' when the binaries link the system OCIO dynamically).
 pkgname=oak-editor
 pkgver=@VERSION@
 pkgrel=1

tooling/package/build-pkg.sh

@@ -27,6 +27,12 @@ rm -rf "$WORK"
 mkdir -p "$WORK"
 sed "s/@VERSION@/$VERSION/" tooling/package/PKGBUILD > "$WORK/PKGBUILD"
 
+# OCIO is linked dynamically whenever the build used the system package
+# (Arch ships no static libOpenColorIO); declare the dependency then.
+if ldd target/release/oak-editor 2>/dev/null | grep -q libOpenColorIO; then
+	sed -i "s/'fontconfig' 'freetype2')/'fontconfig' 'freetype2' 'opencolorio')/" "$WORK/PKGBUILD"
+fi
+
 if [ "$(id -u)" = "0" ]; then
 	useradd -m builder 2>/dev/null || true
 	chown -R builder:builder "$WORK" target/release