fix(host): NVENC open-failure resilience — backoff, failed-open hygiene, self-diagnosis

Field report (Linux direct NVENC): after a codec switch, every session open
failed with NV_ENC_ERR_INVALID_VERSION until the host process was restarted —
so the poisoned state is per-process, not a driver install issue. On-hardware
investigation (RTX 5070 Ti, 610.43.03) could not reproduce it with clean codec
cycles, dirty teardowns, or open/destroy storms, but established the failure
class: the driver enforces a per-process concurrent-session cap (12 there,
status INCOMPATIBLE_CLIENT_KEY; other branches report differently) whose
exhaustion is exactly this signature — persistent open failures healed only by
a process restart. Harden every path that can feed or mask that state:

* Rebuild backoff: the in-place encoder-rebuild retries slept one frame
  interval, so all 5 attempts burned within ~40 ms at 120 Hz — no driver-side
  transient (deferred teardown of the previous session, engine reset) can
  clear that fast. Exponential backoff 100 ms → 1.6 s (~3 s total) so
  transients heal instead of killing the session.
* Destroy-on-failed-open (Linux + Windows, all four open sites): the NVENC
  docs require NvEncDestroyEncoder even when OpenEncodeSessionEx FAILS — the
  driver may have allocated the session slot before erroring. Without it a
  retry burst against a transient leaks slots toward the cap, converting the
  transient into permanent exhaustion.
* Teardown: a destroy_encoder failure (a session slot the driver may keep) is
  now logged with its status instead of silently discarded.
* One-shot self-diagnosis on a failed session open (Linux): retry the raw open
  on a fresh dedicated CUDA context and log which of the three causes applies
  — shared-context poisoned (fresh works), driver-level skew/exhaustion/GPU
  loss (fresh fails the same way), or CUDA itself unhealthy (no fresh context)
  — so the next field report pinpoints the root cause with zero reporter
  effort.

On-hardware regression tests (RTX box .21, all green): codec-switch reopen
cycle (H265→AV1→H265→H264→H265), dirty teardown with in-flight encodes, and
the full open-failure→diagnosis→in-place-recovery path via real session-cap
exhaustion. Existing RFI/reconfigure/4:4:4 smokes still pass; clippy clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/linux/zerocopy/cuda.rs

@@ -120,6 +120,7 @@ struct CudaApi {
     cuInit: unsafe extern "C" fn(c_uint) -> CUresult,
     cuDeviceGet: unsafe extern "C" fn(*mut CUdevice, c_int) -> CUresult,
     cuCtxCreate_v2: unsafe extern "C" fn(*mut CUcontext, c_uint, CUdevice) -> CUresult,
+    cuCtxDestroy_v2: unsafe extern "C" fn(CUcontext) -> CUresult,
     cuCtxSetCurrent: unsafe extern "C" fn(CUcontext) -> CUresult,
     cuMemAllocPitch_v2:
         unsafe extern "C" fn(*mut CUdeviceptr, *mut usize, usize, usize, c_uint) -> CUresult,
@@ -214,6 +215,7 @@ fn cuda_api() -> Option<&'static CudaApi> {
                 cuInit: *lib.get(b"cuInit\0").ok()?,
                 cuDeviceGet: *lib.get(b"cuDeviceGet\0").ok()?,
                 cuCtxCreate_v2: *lib.get(b"cuCtxCreate_v2\0").ok()?,
+                cuCtxDestroy_v2: *lib.get(b"cuCtxDestroy_v2\0").ok()?,
                 cuCtxSetCurrent: *lib.get(b"cuCtxSetCurrent\0").ok()?,
                 cuMemAllocPitch_v2: *lib.get(b"cuMemAllocPitch_v2\0").ok()?,
                 cuMemFree_v2: *lib.get(b"cuMemFree_v2\0").ok()?,
@@ -275,6 +277,12 @@ unsafe fn cuCtxCreate_v2(pctx: *mut CUcontext, flags: c_uint, dev: CUdevice) ->
         None => CU_ERROR_NOT_LOADED,
     }
 }
+unsafe fn cuCtxDestroy_v2(ctx: CUcontext) -> CUresult {
+    match cuda_api() {
+        Some(a) => (a.cuCtxDestroy_v2)(ctx),
+        None => CU_ERROR_NOT_LOADED,
+    }
+}
 unsafe fn cuCtxSetCurrent(ctx: CUcontext) -> CUresult {
     match cuda_api() {
         Some(a) => (a.cuCtxSetCurrent)(ctx),
@@ -610,6 +618,37 @@ pub fn make_current() -> Result<()> {
     unsafe { ck(cuCtxSetCurrent(ctx), "cuCtxSetCurrent") }
 }
 
+/// DIAGNOSTIC-ONLY: create a fresh dedicated context on device 0, run `probe` with it, destroy it,
+/// and restore the shared context as current. Used by the NVENC backend's session-open
+/// self-diagnosis to split "this process's shared context is in a bad state" (probe succeeds on
+/// the fresh context) from a driver-level condition like version skew or session exhaustion
+/// (probe fails there too). Never used on a hot path.
+pub fn with_fresh_context<R>(probe: impl FnOnce(CUcontext) -> R) -> Result<R> {
+    if cuda_api().is_none() {
+        bail!("libcuda.so.1 not available");
+    }
+    // SAFETY: the driver table is present (checked above). `cuInit(0)` is idempotent. `&mut dev`/
+    // `&mut ctx` are live, distinct stack out-params for their synchronous calls. On success `ctx`
+    // is a valid dedicated context, destroyed exactly once below; the shared context is restored
+    // as current afterwards (creation left the fresh one current on this thread).
+    unsafe {
+        ck(cuInit(0), "cuInit")?;
+        let mut dev: CUdevice = 0;
+        ck(cuDeviceGet(&mut dev, 0), "cuDeviceGet")?;
+        let mut ctx: CUcontext = std::ptr::null_mut();
+        ck(
+            cuCtxCreate_v2(&mut ctx, CU_CTX_SCHED_BLOCKING_SYNC, dev),
+            "cuCtxCreate_v2 (diagnostic)",
+        )?;
+        let r = probe(ctx);
+        let _ = cuCtxDestroy_v2(ctx);
+        if let Some(c) = CONTEXT.get() {
+            let _ = cuCtxSetCurrent(c.0);
+        }
+        Ok(r)
+    }
+}
+
 thread_local! {
     /// Per-thread copy stream. `None` until first use; `Some(null)` means "creation failed, use the
     /// default (NULL) stream". Per-thread (not shared) so each worker's `cuStreamSynchronize` waits