feat: M1 lumen-core (FEC/crypto/packet/session + C ABI) and workspace scaffold

Ground-up low-latency streaming stack per docs/implementation-plan.md. M1 is
complete and tested; Linux host backends are cfg-gated stubs to be filled in on
real hardware (M0/M2).

lumen-core (built + tested on macOS/aarch64 — 21 tests):
- fec: ErasureCoder over GF(2^8) (reed-solomon-erasure, Moonlight-compatible)
  and GF(2^16) Leopard-RS (reed-solomon-simd, the >1 Gbps wall-breaker); proptested
- packet: zero-copy #[repr(C)] framing, multi-block, FEC-aware reassembly
- crypto: AES-128-GCM with per-direction nonce salts + sequence-as-AAD
- session: host submit / client poll hot paths + input; loopback & UDP transports
- abi: opaque handles, versioned LumenConfig, panic guards; cbindgen-generated header
- acceptance: Rust loopback+proptest and a C harness that links the staticlib

Scaffold (compiles green on all platforms): lumen-host (vdisplay/capture/encode/
inject/web/pipeline seams under cfg(linux)), lumen-client-rs, tools/{loss-harness,
latency-probe}, Apple/Android client stubs, Gitea CI, docs.

Hardened against a multi-agent adversarial review (13 verified findings fixed,
regression-tested): reassembler memory-DoS bounds + block-consistency validation,
GCM nonce-reuse direction separation, ABI struct_size guard + range checks, FEC
shard-length guards, shard_payload datagram bound, key zeroization + Debug redaction.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/lumen-host/src/pipeline.rs

@@ -0,0 +1,39 @@
+//! The host hot path (plan §7), wiring the platform stages to `lumen_core`:
+//!
+//! ```text
+//! capture(dmabuf) → encode(NVENC/VAAPI) → core[FEC+packetize+pace+send]
+//! ```
+//!
+//! Each stage runs on its own native OS thread, connected by bounded SPSC channels with
+//! drop-oldest on overflow so the encoder is never blocked. No async runtime here.
+
+use crate::capture::Capturer;
+use crate::encode::{EncodedFrame, Encoder};
+use anyhow::Result;
+use lumen_core::packet::{FLAG_PIC, FLAG_SOF};
+use lumen_core::Session;
+
+/// Drive one capture→encode→submit step. The real pipeline spawns threads and uses
+/// bounded channels; this documents the data flow and the `lumen_core` submit contract.
+pub fn pump_once(
+    capturer: &mut dyn Capturer,
+    encoder: &mut dyn Encoder,
+    session: &mut Session,
+) -> Result<()> {
+    let frame = capturer.next_frame()?;
+    encoder.submit(&frame)?;
+    while let Some(EncodedFrame {
+        data,
+        pts_ns,
+        keyframe,
+    }) = encoder.poll()?
+    {
+        let mut flags = FLAG_PIC as u32;
+        if keyframe {
+            flags |= FLAG_SOF as u32;
+        }
+        // core does FEC + packetize + pace + send.
+        session.submit_frame(&data, pts_ns, flags)?;
+    }
+    Ok(())
+}