refactor: purge CHandle from module internals (M14 R5)

Module-internal object references are Rust types now (values, Arc,
Mutex); CHandle remains only at the oakengine C-ABI boundary:

- oakundo: the global stack holds UndoStack/UndoCommand values
  directly (stack token is the static's address)
- oaktimeline: marker/workarea boxes carry Arc<Mutex<T>>; commands
  share the same allocation through Arc clones (readers in oakengine
  stubs and the app's graphops updated to lock)
- oaktask/oakstorage: sessions, write-through bindings and the
  database backend pass ProjectArc; the Session drops its manual
  release bookkeeping; nodeutil keeps the CHandle<->Arc boundary
  conversion (release_project restored for the app)
- oakcodec: handle.rs deleted outright (no facade entry needed it);
  texture/block placeholders are unit structs
- oakrender: copier's project handle is an identity u64; alive-count
  machinery removed; handle.rs is make_owned/get/get_mut only
- oakplugin: the instance registry is gone (its unregister key never
  matched, leaking weak entries); handle.rs is the RefBox boundary type
- oaknode/oakcommon: only dead guard/borrow helpers removed; external
  payload handles (texture/processor) documented as the boundary

Flake hunts landed along the way: the audio recording test serializes
on the shared manager lock with a normalized state; the autocacher
cancel test uses a slow producer so cancellation is deterministic.

crates/oakcodec/src/encoder.rs

@@ -29,7 +29,8 @@ use oakcore_rs::{PixelFormat, SampleFormat};
 use crate::encodingparams::EncodingParams;
 use crate::frame::Frame;
 
-/// `olive::Encoder` — encoder trait. Backs the refcounted encoder handle.
+/// `olive::Encoder` — encoder trait. Instances are handed out as
+/// `Arc<dyn Encoder>`.
 pub trait Encoder: Send + Sync {
 	/// Unique encoder id.
 	fn id(&self) -> String;
@@ -129,8 +130,8 @@ pub fn set_test_encoders(list: Vec<Arc<dyn Encoder>>) {
 /// WebM, SRT → FFmpeg; OpenEXR, PNG, TIFF → OIIO; anything else → `None`).
 /// A non-empty test-injected list (see [`set_test_encoders`]) wins over the
 /// built-in mapping. The concrete implementations are dylib stubs whose
-/// `open()` fails with a clear message, so an initialized encoder handle is
-/// always constructible for a recognized format.
+/// `open()` fails with a clear message, so an initialized encoder is always
+/// constructible for a recognized format.
 pub fn create_from_params(params: &EncodingParams) -> Option<Arc<dyn Encoder>> {
 	if let Some(store) = TEST_ENCODERS.get() {
 		let injected = store.lock().unwrap();