refactor(engine): pure cdylib + undo-stack test race fix (M14 R4)

- oakengine is now cdylib-only (no rlib/staticlib consumers anywhere;
  cargo tree verified) — the plugin/external C ABI layer; README and
  docs updated
- cd.yml drops the dylib embedding/re-sign steps (the app no longer
  links it)
- test race root-caused and fixed for good: the global undo stack lock
  is now a re-entrant mutex (parking_lot) shared by every test that
  drives the stack, including the previously unlocked node/render
  families; the render-manager serial-ordering bug (an earlier repro
  test initialized the global manager before the not-initialized test)
  is fixed with a shared SERIAL guard and a manager shutdown
- 5 consecutive parallel runs clean; serial 209/209

docs/build.md

@@ -3,8 +3,11 @@
 This document describes how to build Oak Video Editor from source on Windows, Linux, and macOS.
 
 > **Note (2026):** Oak is now a Rust workspace; `cargo build` at the
-> repository root produces the app, the CLI, the worker and
-> `liboakengine`. The CMake instructions below are kept for historical
+> repository root produces the app, the CLI and the worker
+> (`liboakengine` — the plugin/external-consumer cdylib — is not a
+> default member, M14 R4; build it explicitly with
+> `cargo build -p oakengine`). The CMake instructions below are kept for
+> historical
 > reference only. Rust dependencies are pulled from crates.io; the only
 > native libraries still needed are FFmpeg (see the next section),
 > OpenColorIO (optional; `ocio-sys` builds a stub without it) and a