ci: vcpkg everywhere, FFmpeg pinned, openKylin container job

- vcpkg bootstrapped in every job (the Warp runners carry none):
  clone + bootstrap into .cache/vcpkg, VCPKG_ROOT exported.
- vcpkg.json: ffmpeg pinned at 9.0.1#1 via overrides with
  builtin-baseline 771b0a2e pinning the port tree; feature fixes
  (gnutls -> openssl, ffnvcodec -> platform-qualified nvcodec,
  vaapi on Linux, librsvg windows-only).
- Linux and macOS CI/CD jobs also take FFmpeg from the manifest
  (static triplets x64-linux / arm64-osx keep the packaging story);
  the build-ffmpeg.sh steps, FFmpeg caches and the codec dev
  packages leave the workflows — system package managers keep only
  the X11/audio/GL/Vulkan/tooling deps, now documented in
  docs/build.md.
- New openKylin container job (openkylin/openkylin:latest) on x64
  (warp-ubuntu-latest-x64-8x) and ARM64
  (warp-ubuntu-latest-arm64-16x, arm64-linux triplet): openKylin
  package names surveyed against the live image's apt index
  (nasm/zip come from the kylinsoft anything3.0 PPA), clang for
  bindgen, xvfb + lavapipe headless tests with the watchdog and
  retry policy.

Known follow-ups (declared in the commit chain): vcpkg has not run
end-to-end yet, the pkg-config vs pkgconf executable name on
Windows, TLS semantics moving gnutls -> openssl.

.gitignore

@@ -15,7 +15,7 @@ CmakeSettings.json
 # clangd's index and likely other things that need not be in the repository
 .cache/
 
-# vcpkg manifest-mode install tree (Windows CI/CD; see vcpkg.json)
+# vcpkg manifest-mode install tree (CI/CD; see vcpkg.json)
 vcpkg_installed/
 
 # Generated packaging assets (icons/icon.png is produced from Oak_Icon.svg