refactor: purge CHandle from module internals (M14 R5)

Module-internal object references are Rust types now (values, Arc,
Mutex); CHandle remains only at the oakengine C-ABI boundary:

- oakundo: the global stack holds UndoStack/UndoCommand values
  directly (stack token is the static's address)
- oaktimeline: marker/workarea boxes carry Arc<Mutex<T>>; commands
  share the same allocation through Arc clones (readers in oakengine
  stubs and the app's graphops updated to lock)
- oaktask/oakstorage: sessions, write-through bindings and the
  database backend pass ProjectArc; the Session drops its manual
  release bookkeeping; nodeutil keeps the CHandle<->Arc boundary
  conversion (release_project restored for the app)
- oakcodec: handle.rs deleted outright (no facade entry needed it);
  texture/block placeholders are unit structs
- oakrender: copier's project handle is an identity u64; alive-count
  machinery removed; handle.rs is make_owned/get/get_mut only
- oakplugin: the instance registry is gone (its unregister key never
  matched, leaking weak entries); handle.rs is the RefBox boundary type
- oaknode/oakcommon: only dead guard/borrow helpers removed; external
  payload handles (texture/processor) documented as the boundary

Flake hunts landed along the way: the audio recording test serializes
on the shared manager lock with a normalized state; the autocacher
cancel test uses a slow producer so cancellation is deterministic.

crates/oakcodec/tests/ffi_contract_test.rs

@@ -30,8 +30,9 @@
 /// stamped). Covers frame/decoder/encoder/conform/proxy `init`
 /// families.
 ///
-/// Covered in `src/ffi/frame.rs` / `decoder.rs` / `encoder.rs` unit
-/// tests (`handle::alive_count` tracks the boxed-object count).
+/// Covered in the (deleted) `src/ffi/*.rs` unit tests; the C-ABI entry
+/// points now live in the oakengine facade, whose own tests assert the
+/// same contract.
 #[test]
 fn handle_contract_all_exports() {
 	// No-op — see the module doc.