fix(capture): capture CPU frames once the encoder proves it can't import dmabufs

A dmabuf import the GPU driver refuses is refused identically on every
retry, but the only recovery above it was the encode-stall ladder: five
in-place encoder rebuilds, then the video session ends. So a host whose
driver will not take what its compositor allocates lost every session
on its first frame, and every reconnect repeated it — while the very
same host streamed fine with `PUNKTFUNK_ZEROCOPY=0`. The software knew
how to run that machine and never chose to.

Latch it, exactly as the sibling CUDA-import path already does after
repeated worker deaths: three consecutive import failures with no frame
in between disable the raw-dmabuf passthrough for the host process, and
capture negotiates CPU frames from the next session on. Three sits
below the encoder's rebuild budget, so the latch is set before the
session it doomed ends — one bad session, then a working (if slower)
host, with a log line saying which and why instead of an operator
having to find an environment variable.

Only the two stages that ARE the import are counted — the buffersrc
push of the DRM-PRIME descriptor and the buffersink pull where `hwmap`
maps it into a VA surface. `avcodec_send_frame` is deliberately left
out: that one is the encoder stalling, which the in-place rebuild
exists to recover, and taking zero-copy away permanently over a
transient fault would be a bad trade.

The latch lives in pf-zerocopy because it is the leaf both sides can
see — the capture→encode edge is one-way by design, so pf-capture
cannot ask pf-encode anything.

crates/pf-zerocopy/src/imp/mod.rs

@@ -232,6 +232,48 @@ pub fn gpu_import_disabled() -> bool {
     GPU_IMPORT_DISABLED.load(Ordering::Relaxed)
 }
 
+/// The same idea for the OTHER zero-copy half: consecutive failures to import a raw dmabuf in the
+/// encoder (VAAPI's libva import, PyroWave's Vulkan one) with no successful frame in between.
+///
+/// That import can fail for reasons no retry can fix — a driver that will not take what the
+/// compositor allocates. The encode-stall recovery above it cannot tell the difference, so it
+/// rebuilt the identical failing encoder five times and then ended the video session, on every
+/// connection, forever: a hybrid Intel/NVIDIA laptop reporting `vaCreateSurfaces` →
+/// `VA_STATUS_ERROR_ALLOCATION_FAILED` on its first frame could not stream at all until its
+/// operator found `PUNKTFUNK_ZEROCOPY=0` by hand. The host already knows how to encode that
+/// machine — capture just has to stop handing it dmabufs. Latching here is what makes the next
+/// session negotiate CPU frames on its own.
+static RAW_DMABUF_FAILURE_STREAK: AtomicU32 = AtomicU32::new(0);
+static RAW_DMABUF_DISABLED: AtomicBool = AtomicBool::new(false);
+/// Below the encoder's own rebuild budget, so the latch is set before the session it doomed ends.
+const RAW_DMABUF_FAILURE_LATCH: u32 = 3;
+
+/// Record an encoder-side raw-dmabuf import failure. Latches the process-wide disable after
+/// [`RAW_DMABUF_FAILURE_LATCH`] consecutive failures.
+pub fn note_raw_dmabuf_import_failure(reason: &str) {
+    let streak = RAW_DMABUF_FAILURE_STREAK.fetch_add(1, Ordering::Relaxed) + 1;
+    if streak >= RAW_DMABUF_FAILURE_LATCH && !RAW_DMABUF_DISABLED.swap(true, Ordering::Relaxed) {
+        tracing::error!(
+            streak,
+            reason,
+            "zero-copy raw-dmabuf passthrough disabled for this host process: the encoder failed \
+             to import the compositor's dmabuf {streak} times in a row — captures fall back to the \
+             CPU path (slower, but this host could not stream at all otherwise)"
+        );
+    }
+}
+
+/// Record a raw dmabuf that imported and encoded — resets the failure streak.
+pub fn note_raw_dmabuf_import_ok() {
+    RAW_DMABUF_FAILURE_STREAK.store(0, Ordering::Relaxed);
+}
+
+/// True once repeated encoder import failures latched the raw-dmabuf passthrough off (see
+/// [`note_raw_dmabuf_import_failure`]).
+pub fn raw_dmabuf_import_disabled() -> bool {
+    RAW_DMABUF_DISABLED.load(Ordering::Relaxed)
+}
+
 /// DRM FourCC for a packed 32-bit format name (little-endian, e.g. `b"XR24"`).
 const fn fourcc(c: &[u8; 4]) -> u32 {
     (c[0] as u32) | ((c[1] as u32) << 8) | ((c[2] as u32) << 16) | ((c[3] as u32) << 24)