ci: vcpkg everywhere, FFmpeg pinned, openKylin container job

- vcpkg bootstrapped in every job (the Warp runners carry none):
  clone + bootstrap into .cache/vcpkg, VCPKG_ROOT exported.
- vcpkg.json: ffmpeg pinned at 9.0.1#1 via overrides with
  builtin-baseline 771b0a2e pinning the port tree; feature fixes
  (gnutls -> openssl, ffnvcodec -> platform-qualified nvcodec,
  vaapi on Linux, librsvg windows-only).
- Linux and macOS CI/CD jobs also take FFmpeg from the manifest
  (static triplets x64-linux / arm64-osx keep the packaging story);
  the build-ffmpeg.sh steps, FFmpeg caches and the codec dev
  packages leave the workflows — system package managers keep only
  the X11/audio/GL/Vulkan/tooling deps, now documented in
  docs/build.md.
- New openKylin container job (openkylin/openkylin:latest) on x64
  (warp-ubuntu-latest-x64-8x) and ARM64
  (warp-ubuntu-latest-arm64-16x, arm64-linux triplet): openKylin
  package names surveyed against the live image's apt index
  (nasm/zip come from the kylinsoft anything3.0 PPA), clang for
  bindgen, xvfb + lavapipe headless tests with the watchdog and
  retry policy.

Known follow-ups (declared in the commit chain): vcpkg has not run
end-to-end yet, the pkg-config vs pkgconf executable name on
Windows, TLS semantics moving gnutls -> openssl.

.github/actionlint.yaml

@@ -4,6 +4,7 @@
 self-hosted-runner:
   labels:
     - warp-ubuntu-latest-x64-8x
+    - warp-ubuntu-latest-arm64-16x
     - warp-windows-latest-x64-16x
     - warp-windows-2025-vs2026-x64-16x
     - warp-macos-26-arm64-6x