refactor(engine): pure cdylib + undo-stack test race fix (M14 R4)

- oakengine is now cdylib-only (no rlib/staticlib consumers anywhere;
  cargo tree verified) — the plugin/external C ABI layer; README and
  docs updated
- cd.yml drops the dylib embedding/re-sign steps (the app no longer
  links it)
- test race root-caused and fixed for good: the global undo stack lock
  is now a re-entrant mutex (parking_lot) shared by every test that
  drives the stack, including the previously unlocked node/render
  families; the render-manager serial-ordering bug (an earlier repro
  test initialized the global manager before the not-initialized test)
  is fixed with a shared SERIAL guard and a manager shutdown
- 5 consecutive parallel runs clean; serial 209/209

crates/oakengine/src/test_support/it_task.rs

@@ -97,7 +97,7 @@ pub(crate) struct SerialGuard {
 	/// The facade's process-wide undo-stack lock (it_undo's), so the
 	/// `oakengine_project_new` calls in these tests (which clear the stack)
 	/// never race the it_undo / it_storage stack tests.
-	_stack: std::sync::MutexGuard<'static, ()>,
+	_stack: parking_lot::ReentrantMutexGuard<'static, ()>,
 }
 
 /// Take the [`SERIAL`] lock AND the global undo-stack lock, recovering
@@ -105,8 +105,7 @@ pub(crate) struct SerialGuard {
 pub(crate) fn serial() -> SerialGuard {
 	let _task = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
 	let _stack = super::it_undo::GLOBAL_STACK_LOCK
-		.lock()
-		.unwrap_or_else(|e| e.into_inner());
+		.lock();
 	SerialGuard { _task, _stack }
 }