refactor(cli,worker): cut liboakengine, link module rlibs directly (M14 R2)

- oak-cli: new engine.rs assembly layer maps every facade call to
  module Rust APIs (oaknode graph/serializer, oaktimeline commands,
  oakrender ticket arena, oaktask ExportTask, oakcommon config); the
  ffi/optional/host layers and build.rs link config are gone
- oak-worker: the worker session + POSIX shm transport moved into the
  crate (oakrender backend + serde_json control plane); no dylib
- both binaries carry zero liboakengine references (otool verified);
  tests green (30 cli / 41 worker)

Cargo.lock

@@ -4753,12 +4753,21 @@ name = "oak-cli"
 version = "0.1.0"
 dependencies = [
  "clap",
+ "oakcodec",
+ "oakcommon",
+ "oakcore-rs",
+ "oaknode",
+ "oakrender",
+ "oaktask",
+ "oaktimeline",
 ]
 
 [[package]]
 name = "oak-worker"
 version = "0.1.0"
 dependencies = [
+ "libc",
+ "oakrender",
  "serde",
  "serde_json",
 ]