feat(recovery): clean mid-stream loss recovery — freeze-until-reanchor + AMD LTR-RFI

Removes the "gray frames with motion" artifact on Vulkan-Video clients and lets
AMD/NVENC hosts re-anchor after loss WITHOUT a 20-40x IDR spike.

Client (pf-client-core): after a reference loss the hardware decoder conceals the
missing-reference deltas (on RADV, a gray plate with new motion painted over) and
returns Ok. The pump now freezes on the last good picture until a clean re-anchor
instead of showing the concealment — lifting on a real IDR, an intra-refresh
recovery mark (2nd wave boundary), or an LTR-RFI recovery anchor (1st). The
frame_index gap is the early, precise loss signal and drives an RFI request.

Host recovery signals (inert unless the backend supports them):
- USER_FLAG_RECOVERY_POINT — intra-refresh wave boundary (NVENC constrained GDR).
- USER_FLAG_RECOVERY_ANCHOR — AMD LTR reference-frame-invalidation recovery frame.

AMD LTR-RFI (encode/windows/amf.rs) — the AMD twin of NVENC RFI. AMF's AVC/HEVC API
has no constrained-intra property (intra-refresh cannot heal; PSNR-proven), so the
only clean-recovery lever is user LTR: mark frames as long-term references, and on
loss force the next frame to re-reference the newest known-good one — a clean
P-frame, not an IDR. Two rotating LTR slots, ~0.5s mark cadence, on by default for
AVC/HEVC (PUNKTFUNK_NO_AMF_LTR disables). invalidate_ref_frames picks the newest LTR
before the loss; a range older than the live slots falls back to a keyframe.

Protocol (punktfunk-core): RfiRequest control message + NativeClient::request_rfi().
Host: RfiRequest dispatch -> invalidate_ref_frames (IDR fallback); an RFI success
anchors the keyframe cooldown so the client's frames_dropped echo of the same loss
is coalesced away rather than emitting a redundant IDR.

Spike: synthetic NV12 GPU source for headless AMF encoder testing.

Validated: core rfi_request_roundtrip; pf-client-core 31 unit tests
(incl. an_rfi_anchor_lifts_immediately); punktfunk-host builds + 271 tests on Linux;
punktfunk-host builds clean on Windows; real AMD iGPU spike (invalidate at frame 90
forced re-reference to LTR frame 60 — 180 frames, keyframes=1, no recovery IDR).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/punktfunk-core/src/packet.rs

@@ -35,6 +35,25 @@ pub const FLAG_SOF: u8 = 0x4;
 /// feeding them to the decoder. Punktfunk/1 only (GameStream never sets it).
 pub const FLAG_PROBE: u8 = 0x8;
 
+/// Application `user_flags` bit (the u32 [`PacketHeader::user_flags`] word, surfaced to the client
+/// as [`crate::session::Frame::flags`]) — NOT a transport packet flag. Marks the access unit that
+/// **completes an intra-refresh wave**: the picture is loss-free from here even though the frame is
+/// a coded `P` (no IDR, so the decoder never sets `AV_FRAME_FLAG_KEY`). The client lifts its
+/// post-loss display freeze on this bit as well as on a real keyframe — the only bitstream-invisible
+/// clean point it can honor without forcing a full IDR. Lives above the low nibble because the host
+/// reuses `FLAG_PIC`/`FLAG_SOF`/`FLAG_PROBE` bit values inside `user_flags`; `0x10` clears all four.
+pub const USER_FLAG_RECOVERY_POINT: u32 = 0x10;
+
+/// Application `user_flags` bit — a **definitive single-frame clean re-anchor**. Unlike
+/// [`USER_FLAG_RECOVERY_POINT`] (an intra-refresh wave boundary, where the first boundary after a loss
+/// is only half-healed so the client waits for the second), this marks an access unit the host coded
+/// to reference a **known-good** picture on purpose — an AMD **LTR reference-frame-invalidation**
+/// recovery frame (`ForceLTRReferenceBitfield`): a clean P-frame off a long-term reference the client
+/// already has, not an IDR. The picture is loss-free the instant this AU decodes, so the client lifts
+/// its post-loss freeze on the **first** such mark. Coded `P` (no IDR), so the decoder never sets
+/// `AV_FRAME_FLAG_KEY` — this host flag is the only signal.
+pub const USER_FLAG_RECOVERY_ANCHOR: u32 = 0x20;
+
 /// Crypto framing overhead [`Session`](crate::session::Session) adds when encrypting:
 /// an 8-byte sequence prefix plus the GCM tag.
 pub const CRYPTO_OVERHEAD: usize = 8 + crate::crypto::TAG_LEN;