ci: vcpkg everywhere, FFmpeg pinned, openKylin container job

- vcpkg bootstrapped in every job (the Warp runners carry none):
  clone + bootstrap into .cache/vcpkg, VCPKG_ROOT exported.
- vcpkg.json: ffmpeg pinned at 9.0.1#1 via overrides with
  builtin-baseline 771b0a2e pinning the port tree; feature fixes
  (gnutls -> openssl, ffnvcodec -> platform-qualified nvcodec,
  vaapi on Linux, librsvg windows-only).
- Linux and macOS CI/CD jobs also take FFmpeg from the manifest
  (static triplets x64-linux / arm64-osx keep the packaging story);
  the build-ffmpeg.sh steps, FFmpeg caches and the codec dev
  packages leave the workflows — system package managers keep only
  the X11/audio/GL/Vulkan/tooling deps, now documented in
  docs/build.md.
- New openKylin container job (openkylin/openkylin:latest) on x64
  (warp-ubuntu-latest-x64-8x) and ARM64
  (warp-ubuntu-latest-arm64-16x, arm64-linux triplet): openKylin
  package names surveyed against the live image's apt index
  (nasm/zip come from the kylinsoft anything3.0 PPA), clang for
  bindgen, xvfb + lavapipe headless tests with the watchdog and
  retry policy.

Known follow-ups (declared in the commit chain): vcpkg has not run
end-to-end yet, the pkg-config vs pkgconf executable name on
Windows, TLS semantics moving gnutls -> openssl.

docs/build.md

@@ -36,6 +36,15 @@ macOS, Linux, and Windows. For the Chinese version see
   config entry is the only machine-agnostic way). The `oak-ffmpeg-link`
   build script panics without it; run `build-ffmpeg.sh` once before the
   first `cargo build`.
+- **CI/CD uses the vcpkg manifest instead of `build-ffmpeg.sh`.** Every
+  desktop job runs `vcpkg install --triplet <x64-windows | x64-linux |
+  arm64-osx | arm64-linux>` against the repo-root `vcpkg.json`, which
+  pins FFmpeg to **9.0.1#1** (`overrides`) and every other port through
+  `builtin-baseline`; the tree lands in `vcpkg_installed/<triplet>` and
+  jobs point `FFMPEG_DIR`/`PKG_CONFIG_PATH` at it. The C/C++ libraries
+  outside that set (OCIO is vendored, the rest come from the system
+  package manager) are unchanged. The local-build path above remains
+  valid and is what the docs below describe.
 
 ## Quick start (macOS / Linux)
 
@@ -88,8 +97,9 @@ cargo test  --workspace         # Linux: see "headless tests" below
 
 > **CI/CD note**: the GitHub Windows CI/CD no longer uses this path — it
 > builds MSVC-ABI on `warp-windows-2025-vs2026-x64-16x` with vcpkg
-> manifest mode (`vcpkg.json` at the repo root: FFmpeg with every free
-> codec + hwaccel, pkgconf, librsvg) and the vendored static OCIO. The
+> manifest mode (`vcpkg.json` at the repo root: FFmpeg 9.0.1 with every
+> free codec + hwaccel, pkgconf, librsvg, all pinned by
+> `overrides`/`builtin-baseline`) and the vendored static OCIO. The
 > MSYS2 flow below remains the documented local-build alternative.
 
 The Windows build targets **x86_64-pc-windows-gnu** with MSYS2's own