feat(moq-video): reintroduce VAAPI via discord/cros-codecs + NV12 surface upload

[kixelated]

Summary

Reintroduces the Intel/AMD VAAPI H.264 encoder for moq-video, dropped in #1704 because cros-codecs 0.0.6 pins cros-libva 0.0.12, which fails to compile against libva >= 2.23.

The unblock is discord/cros-codecs (branch discord-0.0.5), an actively-maintained fork (Discord ships it for Go Live) that bumps to cros-libva 0.0.13 and hardens the H.264 VAAPI encoder (packed SPS/PPS + slice headers, frame_num, rate control). It's consumed as plain git dependencies, with no fork of our own.

• dlopen, like NVENC. The vaapi feature enables cros-codecs' vaapi_dlopen, which loads libva at runtime via the cros-libva dlopen feature (discord/cros-libva#discord-0.0.13, pulled through a root [patch.crates-io]). So a vaapi-enabled binary links on a libva-less builder and loads on a libva-less machine, falling back to openh264. The build still needs libva headers for bindgen, so libva is back in the nix devShell.
• Input is an NV12 surface upload, not zero-copy dmabuf. VAAPI's H.264 encoder wants an NV12 VA surface, but UVC webcams deliver YUYV/MJPEG (decoded to CPU I420) and rarely offer NV12 to import zero-copy. So backend/vaapi.rs drives new_native_vaapi with a VaSurfacePool and uploads each I420 frame into a pooled VA surface as NV12. This works with the existing CPU V4L2 capture, no new capture code.

Zero-copy dmabuf (Frame::DmaBuf + a VIDIOC_EXPBUF capture + DrmPrime2 surface import) for the rare NV12-capable V4L2 source is a deliberate follow-up.

Public API

No public API or wire change. The vaapi feature is off by default and Linux-gated; the codec-agnostic moq-video surface (Encoder, Config, Kind) is untouched. Additive only.

Test plan

• Default macOS build green (cargo check -p moq-video; vaapi is cfg'd out).
• Git deps resolve and lock to the discord forks; the cros-libva patch applies (no unused-patch warning).
• rustfmt clean (incl. the cfg-gated vaapi.rs).
• Linux cargo clippy -p moq-video --all-targets --all-features -- -D warnings green (nvenc + vaapi both active), verified in a Linux container. Caught one missing field (FrameMetadata.force_idr), now fixed.
• cargo deny check licenses sources ok (the new transitive licenses are already allow-listed).
• Hardware validation on Linux + Intel/AMD GPU still pending: the low_power entrypoint (recent Intel iHD may need true), and the NV12 upload pitch handling round-trip.

Targets dev because it adds git-patched dependencies and belongs to the native-codecs effort.

(Written by Claude)