feat(oakrender): render-process isolation S1 - dispatcher, scheduler, real worker
Per the M15 design (docs/zh/plans/riir/M15-render-process-isolation.md):
- ipc.rs moved into oakrender with protocol v2: hello_caps,
render_batch, batch_accepted, frame_failed; main-process-assigned
slots; BGRA8 slot format. POSIX shm verified to 1GiB on macOS.
- ProcessDispatcher: spawns oak-worker processes, handshake, stdio
NDJSON control, shm segment lifecycle with generation-tagged keys,
crash detection with bounded restart and frame redispatch, zero-copy
ShmFrameRef delivery and copy counters.
- PreviewScheduler: interleaved batch claiming (frame % W per worker,
no work stealing), seek > playback-distance > background priority,
credit-based flow control, crash recovery.
- oak-worker renders for real: graph snapshot deserialization, montage
decode+composite straight into the assigned shm slot, F32->BGRA8
final conversion in-worker, OFX plugin executor installed in-worker,
crash hooks for isolation testing.
Thread pool coexists for now (S2 removes it). Integration tests cover
two-worker zero-copy rendering, crash isolation with redelivery, and
real H.264 footage decode into slots.
Mike-Solar
431b9ed2b1