feat: M1 lumen-core (FEC/crypto/packet/session + C ABI) and workspace scaffold

Ground-up low-latency streaming stack per docs/implementation-plan.md. M1 is
complete and tested; Linux host backends are cfg-gated stubs to be filled in on
real hardware (M0/M2).

lumen-core (built + tested on macOS/aarch64 — 21 tests):
- fec: ErasureCoder over GF(2^8) (reed-solomon-erasure, Moonlight-compatible)
  and GF(2^16) Leopard-RS (reed-solomon-simd, the >1 Gbps wall-breaker); proptested
- packet: zero-copy #[repr(C)] framing, multi-block, FEC-aware reassembly
- crypto: AES-128-GCM with per-direction nonce salts + sequence-as-AAD
- session: host submit / client poll hot paths + input; loopback & UDP transports
- abi: opaque handles, versioned LumenConfig, panic guards; cbindgen-generated header
- acceptance: Rust loopback+proptest and a C harness that links the staticlib

Scaffold (compiles green on all platforms): lumen-host (vdisplay/capture/encode/
inject/web/pipeline seams under cfg(linux)), lumen-client-rs, tools/{loss-harness,
latency-probe}, Apple/Android client stubs, Gitea CI, docs.

Hardened against a multi-agent adversarial review (13 verified findings fixed,
regression-tested): reassembler memory-DoS bounds + block-consistency validation,
GCM nonce-reuse direction separation, ABI struct_size guard + range checks, FEC
shard-length guards, shard_payload datagram bound, key zeroization + Debug redaction.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/lumen-core/build.rs

@@ -0,0 +1,32 @@
+//! Generate the C header (`include/lumen_core.h`) from the `extern "C"` surface.
+//!
+//! cbindgen failure is a warning, not a hard error, so the crate still builds in minimal
+//! environments (e.g. a CI image without the full toolchain); the header is checked in.
+
+use std::env;
+use std::path::PathBuf;
+
+fn main() {
+    println!("cargo:rerun-if-changed=src/abi.rs");
+    println!("cargo:rerun-if-changed=src/config.rs");
+    println!("cargo:rerun-if-changed=src/input.rs");
+    println!("cargo:rerun-if-changed=cbindgen.toml");
+
+    let crate_dir = env::var("CARGO_MANIFEST_DIR").expect("CARGO_MANIFEST_DIR");
+    // Workspace-level include/ dir: crates/lumen-core/ -> ../../include/
+    let out = PathBuf::from(&crate_dir)
+        .join("..")
+        .join("..")
+        .join("include")
+        .join("lumen_core.h");
+
+    match cbindgen::generate(&crate_dir) {
+        Ok(bindings) => {
+            bindings.write_to_file(&out);
+            println!("cargo:warning=lumen-core: wrote {}", out.display());
+        }
+        Err(e) => {
+            println!("cargo:warning=lumen-core: cbindgen failed ({e}); header not regenerated");
+        }
+    }
+}