feat(host): vendor PyroWave + minimal Granite subset as crates/pyrowave-sys

Phase 0 of design/pyrowave-codec-plan.md — the opt-in wired-LAN ultra-low-
latency codec. Vendored at upstream 509e4f88 (API 0.4.0, Granite 44362775,
volk + vulkan-headers pins in PUNKTFUNK-VENDOR.txt), pruned to the 6.6 MB
the standalone no-renderer build needs; scripts/vendor-pyrowave.sh
reproduces the tree (a pin bump is protocol-affecting, plan §4.2).

build.rs drives the wrapper CMakeLists (static archives incl. a static
C-API lib upstream only ships shared) + bindgen over pyrowave.h; Linux and
Windows only, empty stub elsewhere (Apple gets a native Metal port, §4.7).
Offline-safe by construction: no network, no system lib, vendored Vulkan
headers — same model as the opus dep (flatpak builder has no network).

Phase-0 validation on .21 (RTX 5070 Ti, driver 610.43.03):
- upstream pyrowave-c-test + interop test (incl. dmabuf/DRM-modifier
  Vulkan<->Vulkan) pass, from the pristine AND the pruned tree
- GPU kernel times at ~1.6 bpp noise: encode/decode 0.090/0.042 ms @800p,
  0.146/0.067 @1080p, 0.226/0.103 @1440p, 0.477/0.201 @4K — order of
  magnitude under NVENC's 1-2 ms retrieve, CBR lands within ~100 B of
  target
- cargo test -p pyrowave-sys green (static link + API-version pin check)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/pyrowave-sys/src/lib.rs

@@ -0,0 +1,29 @@
+//! Raw FFI bindings to the vendored PyroWave C API (`pyrowave.h`).
+//!
+//! Empty on targets other than Linux/Windows — see build.rs. The safe wrapper
+//! lives with its consumer (`punktfunk-host`'s encoder backend, and later the
+//! Rust clients' decoder backend); this crate is bindings only.
+
+#![allow(non_upper_case_globals)]
+#![allow(non_camel_case_types)]
+#![allow(non_snake_case)]
+// Bindgen output for a C API: u128 layout warnings and the like are upstream's concern.
+#![allow(improper_ctypes)]
+
+#[cfg(any(target_os = "linux", target_os = "windows"))]
+include!(concat!(env!("OUT_DIR"), "/bindings.rs"));
+
+#[cfg(all(test, any(target_os = "linux", target_os = "windows")))]
+mod tests {
+    use super::*;
+
+    /// Link sanity: statically linked archives resolve and the vendored pin is
+    /// the API version we designed against. No GPU or Vulkan loader required —
+    /// the version query touches no device state.
+    #[test]
+    fn api_version_matches_vendored_pin() {
+        let (mut major, mut minor, mut patch) = (0u32, 0u32, 0u32);
+        unsafe { pyrowave_get_api_version(&mut major, &mut minor, &mut patch) };
+        assert_eq!((major, minor, patch), (0, 4, 0), "vendored pyrowave API version moved — re-check the §4.2 protocol coupling before bumping");
+    }
+}