fix(build): launch crash — @rpath/libz.1.dylib had no LC_RPATH

The static FFmpeg's external codec libs pull in -lz, which on this
toolchain resolves to a copy whose install name is @rpath/libz.1.dylib
(zlib-ng-compat); without an LC_RPATH entry all three binaries died in
dyld at startup. The app/cli/worker build scripts now emit
-Wl,-rpath,/usr/lib.

Also: FFMPEG_DIR moves into the committed .cargo/config.toml as a
workspace-relative [env] entry — ffmpeg-sys-next's build script cannot
read .env files, and without it the crate silently linked the shared
Homebrew FFmpeg while oakffmpeg-link emitted the static transitive
flags (mixed linkage). docs/build.md updated.

docs/zh/plans/riir/M14-direct-rlib.md

@@ -1,4 +1,4 @@
-# M14：前端绕过 facade 直链 rlib（纯 Rust ABI）
+ # M14：前端绕过 facade 直链 rlib（纯 Rust ABI）
 
 > 前置：单库化（single-lib.md）+ 模块 bridge/ffi 清除已完成；
 > liboakengine.dylib 的 C ABI 冻结，专供插件/外部消费者。