feat(core,host): CODEC_PYROWAVE negotiation — opt-in only, host dispatch wired

Phase 2a+2c of design/pyrowave-codec-plan.md.

Core: CODEC_PYROWAVE = 0x08 on Hello::video_codecs/Welcome::codec.
Deliberately absent from resolve_codec's precedence ladder (plan §3 —
a 100-400 Mbps codec must never win a negotiation by mere mutual
support): reachable exclusively through the client's explicit
preferred_codec. Invariant tests cover never-auto-selected (even as the
only shared codec), preferred-path selection, and graceful fallback.
ABI mirror PUNKTFUNK_CODEC_PYROWAVE + lockstep assert for the
Apple/Android embedders.

Host: Codec::PyroWave variant threaded through the wire mappings; a
negotiated PyroWave session routes straight to the backend ahead of the
PUNKTFUNK_ENCODER pref dispatch (which stays a lab override). The
advertisement bit rides host_wire_caps only when the capture side would
actually deliver ingestible frames — linux_zero_copy_is_vaapi(), i.e.
AMD/Intel auto or an explicit operator pref on NVIDIA; per-session
raw-dmabuf OutputFormat plumbing is recorded as the Phase-3 item. The
libavcodec name helpers are dispatch-guarded unreachable; the web
console gains ApiCodec::PyroWave (api/openapi.json regenerated).

Validated on .21: 308 host tests green with and without the feature,
145 core tests green with quic, clippy clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-core/src/quic/tests.rs

@@ -101,6 +101,30 @@ fn codec_negotiation_and_back_compat() {
     // A preference the host can't emit still can't rescue a no-shared-codec case.
     assert_eq!(resolve_codec(CODEC_HEVC, CODEC_H264, CODEC_HEVC), None);
 
+    // PyroWave is opt-in ONLY (plan §3): mutual support NEVER auto-selects it — the ladder
+    // ignores it entirely...
+    assert_eq!(
+        resolve_codec(CODEC_HEVC | CODEC_PYROWAVE, CODEC_HEVC | CODEC_PYROWAVE, 0),
+        Some(CODEC_HEVC)
+    );
+    // ...even when it is the ONLY shared codec (an all-intra 200 Mbps stream must never be a
+    // silent fallback)...
+    assert_eq!(resolve_codec(CODEC_PYROWAVE, CODEC_PYROWAVE, 0), None);
+    // ...it is reachable exclusively through the client's explicit preference.
+    assert_eq!(
+        resolve_codec(
+            CODEC_HEVC | CODEC_PYROWAVE,
+            CODEC_HEVC | CODEC_PYROWAVE,
+            CODEC_PYROWAVE
+        ),
+        Some(CODEC_PYROWAVE)
+    );
+    // A pyrowave preference against a host without the backend falls back to the ladder.
+    assert_eq!(
+        resolve_codec(CODEC_HEVC | CODEC_PYROWAVE, CODEC_HEVC, CODEC_PYROWAVE),
+        Some(CODEC_HEVC)
+    );
+
     // A Hello advertising codecs roundtrips, and the wire form of a codec-only Hello decodes on
     // a build that ignores the trailing byte (back-compat: extra bytes are skipped).
     let h = Hello {