fix(encode): harden loss-recovery correctness across host encoders (F1–F7)

Phases 1–4 of design/encoder-recovery-hardening.md — make the shipped RFI/
freeze-until-reanchor recovery honest and rebuild-safe across every backend.

F1 — frame-index domain desync: the encode loop now owns a session-lifetime
`au_seq`; `Encoder::submit_indexed(au_seq + inflight)` pins NVENC inputTimeStamp
and AMF LTR slots to the WIRE frame index, so `invalidate_ref_frames` compares
client frame numbers in the same domain and survives adaptive-bitrate rebuilds
(an internal counter desynced on the first rebuild → RFI silently dead / an AMF
force-ref onto a never-decoded frame). `FrameMsg.frame_index` →
`Session::seal_frame_at`; GameStream gets the same via `VideoPacketizer::
packetize(.., Some(idx))`.

F2 — Windows NVENC left the client frozen ~1s per loss: NVENC RFI was
transparent (no anchor tag) while the session glue armed the 750ms IDR cooldown,
so the freeze only lifted on the ~1s keyframe re-ask. NVENC now mirrors AMF —
`pending_anchor` tags the first post-invalidate AU (the clean re-anchor
P-frame) `recovery_anchor`, incl. the covering-range dedupe re-arm; the client
lifts at ~RTT.

F3 — speed-test probe filler burned video frame indexes: moved to its own index
space (`Packetizer::alloc_probe_index` + `Session::submit_probe_frame`) with a
second client reassembly window routed on FLAG_PROBE, gated on the new
VIDEO_CAP_PROBE_SEQ Hello bit (mid-session probes declined for older clients).

F4 — RFI range sanity cap: forward gaps wider than `packet::RFI_MAX_RANGE` (256)
resync via keyframe instead of an out-of-range RFI, host- and client-side
(client huge-gap → keyframe in `RfiRecovery::observe` + the pf-client-core pump).

F5 — reset() parity: Windows NVENC (teardown + lazy re-init), Linux VAAPI
(drop-inner), Linux NVENC (reopen from stored OpenArgs) now give the stall
watchdog a heal lever instead of ending the session.

F6 — sw.rs `pending: VecDeque` (was `Option`), killing the silent AU drop at
capturer pipeline depth > 1. F7 — doc sweep on the RFI/anchor comments.

Verified: punktfunk-core lib tests (macOS + Linux), full punktfunk-host suite on
Linux (RTX 5070 Ti), Windows compile. Owed: the on-glass client matrix (F2
freeze A/B, AMF LTR spike across a bitrate rebuild).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/pf-client-core/src/session.rs

@@ -462,12 +462,21 @@ fn pump(
                             // paths (one recovery ask per 100 ms) so a burst of gaps — a full-screen
                             // pan shedding shards — can't storm the control stream. This fires ~120 ms
                             // before frames_dropped would, so recovery also starts sooner.
+                            //
+                            // A gap wider than RFI_MAX_RANGE is beyond any encoder's reference
+                            // history (a seconds-long outage — or a phantom index jump, e.g. the
+                            // first real AU after an old host's speed-test burst consumed video
+                            // indexes): RFI is hopeless there, so ask for the IDR resync directly.
                             if last_kf_req
                                 .is_none_or(|t| now.duration_since(t) >= Duration::from_millis(100))
                             {
                                 last_kf_req = Some(now);
-                                let _ =
-                                    connector.request_rfi(exp, frame.frame_index.wrapping_sub(1));
+                                if gap > punktfunk_core::packet::RFI_MAX_RANGE {
+                                    let _ = connector.request_keyframe();
+                                } else {
+                                    let _ = connector
+                                        .request_rfi(exp, frame.frame_index.wrapping_sub(1));
+                                }
                             }
                             tracing::trace!(
                                 gap,