feat(recovery): clean mid-stream loss recovery — freeze-until-reanchor + AMD LTR-RFI

Removes the "gray frames with motion" artifact on Vulkan-Video clients and lets
AMD/NVENC hosts re-anchor after loss WITHOUT a 20-40x IDR spike.

Client (pf-client-core): after a reference loss the hardware decoder conceals the
missing-reference deltas (on RADV, a gray plate with new motion painted over) and
returns Ok. The pump now freezes on the last good picture until a clean re-anchor
instead of showing the concealment — lifting on a real IDR, an intra-refresh
recovery mark (2nd wave boundary), or an LTR-RFI recovery anchor (1st). The
frame_index gap is the early, precise loss signal and drives an RFI request.

Host recovery signals (inert unless the backend supports them):
- USER_FLAG_RECOVERY_POINT — intra-refresh wave boundary (NVENC constrained GDR).
- USER_FLAG_RECOVERY_ANCHOR — AMD LTR reference-frame-invalidation recovery frame.

AMD LTR-RFI (encode/windows/amf.rs) — the AMD twin of NVENC RFI. AMF's AVC/HEVC API
has no constrained-intra property (intra-refresh cannot heal; PSNR-proven), so the
only clean-recovery lever is user LTR: mark frames as long-term references, and on
loss force the next frame to re-reference the newest known-good one — a clean
P-frame, not an IDR. Two rotating LTR slots, ~0.5s mark cadence, on by default for
AVC/HEVC (PUNKTFUNK_NO_AMF_LTR disables). invalidate_ref_frames picks the newest LTR
before the loss; a range older than the live slots falls back to a keyframe.

Protocol (punktfunk-core): RfiRequest control message + NativeClient::request_rfi().
Host: RfiRequest dispatch -> invalidate_ref_frames (IDR fallback); an RFI success
anchors the keyframe cooldown so the client's frames_dropped echo of the same loss
is coalesced away rather than emitting a redundant IDR.

Spike: synthetic NV12 GPU source for headless AMF encoder testing.

Validated: core rfi_request_roundtrip; pf-client-core 31 unit tests
(incl. an_rfi_anchor_lifts_immediately); punktfunk-host builds + 271 tests on Linux;
punktfunk-host builds clean on Windows; real AMD iGPU spike (invalidate at frame 90
forced re-reference to LTR frame 60 — 180 frames, keyframes=1, no recovery IDR).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/punktfunk-host/src/encode.rs

@@ -19,6 +19,13 @@ pub struct EncodedFrame {
     pub pts_ns: u64,
     /// True for IDR/keyframes (sets the SOF/keyframe wire flags).
     pub keyframe: bool,
+    /// True when this AU is a **reference-frame-invalidation recovery frame** — a clean P-frame the
+    /// encoder coded against a known-good reference in response to
+    /// [`invalidate_ref_frames`](Encoder::invalidate_ref_frames) (AMD LTR force-reference). The pump
+    /// tags it [`punktfunk_core::packet::USER_FLAG_RECOVERY_ANCHOR`] so the client lifts its post-loss
+    /// freeze on it without an IDR. Only the native-AMF LTR path sets it; every other backend leaves
+    /// it `false` (their RFI, when present, re-references transparently with no distinct clean-point AU).
+    pub recovery_anchor: bool,
 }
 
 /// Codec selection negotiated with the client.
@@ -208,12 +215,28 @@ pub struct EncoderCaps {
     /// the encoder's real chroma disagrees with what was negotiated (the in-band SPS is authoritative
     /// for the decoder either way).
     pub chroma_444: bool,
-    /// The encoder runs a periodic **intra-refresh wave** (a moving band of intra blocks +
-    /// recovery-point SEI, no periodic IDR): FEC-unrecoverable loss self-heals within one wave, so
-    /// the session glue rate-limits client keyframe requests instead of answering each with a full
-    /// IDR (the 20-40× frame-size spike that cascades under loss). Linux NVENC sets it when
-    /// `PUNKTFUNK_INTRA_REFRESH` opened the encoder in that mode; VAAPI/software never do.
+    /// The encoder runs a periodic **intra-refresh wave** — a moving band of intra blocks that
+    /// re-codes the whole picture over ~0.5 s, no periodic IDR. FEC-unrecoverable loss self-heals as
+    /// the band sweeps, so the session glue rate-limits client keyframe requests instead of answering
+    /// each with a full IDR (the 20-40× frame-size spike that cascades under loss). Linux NVENC / AMF
+    /// set it when `PUNKTFUNK_INTRA_REFRESH` opened the encoder in that mode; VAAPI/QSV/software never
+    /// do. NOTE — the wave carries NO decoder-visible clean-point: FFmpeg never sets `AV_FRAME_FLAG_KEY`
+    /// at a recovery point (H.264 flags key only when `recovery_frame_cnt == 0`; HEVC only on IRAP),
+    /// and AMF emits no recovery-point SEI at all. So this cap ALONE does not let the client lift its
+    /// post-loss freeze without an IDR — that needs [`intra_refresh_recovery`](Self::intra_refresh_recovery).
     pub intra_refresh: bool,
+    /// The intra-refresh wave is a *validated constrained GDR* — verified on real hardware to fully
+    /// heal a lost picture within one wave period with no residual artifacts. Only then does the host
+    /// tag each wave-boundary AU with [`USER_FLAG_RECOVERY_POINT`](punktfunk_core::packet::USER_FLAG_RECOVERY_POINT),
+    /// so the client can lift its freeze on the second mark (a proven clean re-anchor) instead of
+    /// waiting out its backstop and forcing a full IDR. Default `false` on every backend until on-glass
+    /// validation flips it — an un-validated encoder keeps the IDR recovery path, so this is inert and
+    /// cannot regress. Meaningless unless [`intra_refresh`](Self::intra_refresh) is also set.
+    pub intra_refresh_recovery: bool,
+    /// Length of the intra-refresh wave in frames — the boundary period the host marks on (it sets
+    /// `USER_FLAG_RECOVERY_POINT` on every Nth emitted AU, re-phased at each IDR). 0 when intra-refresh
+    /// is off. Only consulted when [`intra_refresh_recovery`](Self::intra_refresh_recovery) is set.
+    pub intra_refresh_period: u32,
 }
 
 /// A hardware encoder. One per session; runs on the encode thread.