refactor: purge CHandle from module internals (M14 R5)

Module-internal object references are Rust types now (values, Arc,
Mutex); CHandle remains only at the oakengine C-ABI boundary:

- oakundo: the global stack holds UndoStack/UndoCommand values
  directly (stack token is the static's address)
- oaktimeline: marker/workarea boxes carry Arc<Mutex<T>>; commands
  share the same allocation through Arc clones (readers in oakengine
  stubs and the app's graphops updated to lock)
- oaktask/oakstorage: sessions, write-through bindings and the
  database backend pass ProjectArc; the Session drops its manual
  release bookkeeping; nodeutil keeps the CHandle<->Arc boundary
  conversion (release_project restored for the app)
- oakcodec: handle.rs deleted outright (no facade entry needed it);
  texture/block placeholders are unit structs
- oakrender: copier's project handle is an identity u64; alive-count
  machinery removed; handle.rs is make_owned/get/get_mut only
- oakplugin: the instance registry is gone (its unregister key never
  matched, leaking weak entries); handle.rs is the RefBox boundary type
- oaknode/oakcommon: only dead guard/borrow helpers removed; external
  payload handles (texture/processor) documented as the boundary

Flake hunts landed along the way: the audio recording test serializes
on the shared manager lock with a normalized state; the autocacher
cancel test uses a slow producer so cancellation is deterministic.

crates/oaknode/src/node.rs

@@ -426,6 +426,12 @@ impl NodeCore {
 
 /// The node's oakrender caches (frame/thumbnail/audio/waveform),
 /// owned handles released with the node.
+///
+/// Cross-module payloads: the cache objects live behind opaque
+/// oakrender handles created lazily by the facade (oakengine reads
+/// `caches.video` directly through the C ABI), and oakrender depends on
+/// oaknode, so no Rust type is nameable here — the handle is the
+/// boundary representation.
 #[derive(Clone)]
 pub struct NodeCaches {
 	/// Video frame hash cache.