ci: vcpkg everywhere, FFmpeg pinned, openKylin container job

- vcpkg bootstrapped in every job (the Warp runners carry none):
  clone + bootstrap into .cache/vcpkg, VCPKG_ROOT exported.
- vcpkg.json: ffmpeg pinned at 9.0.1#1 via overrides with
  builtin-baseline 771b0a2e pinning the port tree; feature fixes
  (gnutls -> openssl, ffnvcodec -> platform-qualified nvcodec,
  vaapi on Linux, librsvg windows-only).
- Linux and macOS CI/CD jobs also take FFmpeg from the manifest
  (static triplets x64-linux / arm64-osx keep the packaging story);
  the build-ffmpeg.sh steps, FFmpeg caches and the codec dev
  packages leave the workflows — system package managers keep only
  the X11/audio/GL/Vulkan/tooling deps, now documented in
  docs/build.md.
- New openKylin container job (openkylin/openkylin:latest) on x64
  (warp-ubuntu-latest-x64-8x) and ARM64
  (warp-ubuntu-latest-arm64-16x, arm64-linux triplet): openKylin
  package names surveyed against the live image's apt index
  (nasm/zip come from the kylinsoft anything3.0 PPA), clang for
  bindgen, xvfb + lavapipe headless tests with the watchdog and
  retry policy.

Known follow-ups (declared in the commit chain): vcpkg has not run
end-to-end yet, the pkg-config vs pkgconf executable name on
Windows, TLS semantics moving gnutls -> openssl.

tooling/install-deps.sh

@@ -21,6 +21,9 @@
 # itself is built from source by tooling/ffmpeg/build-ffmpeg.sh (which
 # installs into .cache/ffmpeg) and is NOT installed here.
 #
+# This is the local-build path. CI/CD gets the same libraries from the
+# vcpkg manifest (root vcpkg.json) instead — see docs/build.md.
+#
 # Supported: Homebrew (macOS), MSYS2 UCRT64 (Windows), Debian/Ubuntu,
 # Fedora, Arch. Run it yourself — nothing in the build invokes it
 # automatically (it needs sudo on Linux).