fix(encode): harden loss-recovery correctness across host encoders (F1–F7)

Phases 1–4 of design/encoder-recovery-hardening.md — make the shipped RFI/
freeze-until-reanchor recovery honest and rebuild-safe across every backend.

F1 — frame-index domain desync: the encode loop now owns a session-lifetime
`au_seq`; `Encoder::submit_indexed(au_seq + inflight)` pins NVENC inputTimeStamp
and AMF LTR slots to the WIRE frame index, so `invalidate_ref_frames` compares
client frame numbers in the same domain and survives adaptive-bitrate rebuilds
(an internal counter desynced on the first rebuild → RFI silently dead / an AMF
force-ref onto a never-decoded frame). `FrameMsg.frame_index` →
`Session::seal_frame_at`; GameStream gets the same via `VideoPacketizer::
packetize(.., Some(idx))`.

F2 — Windows NVENC left the client frozen ~1s per loss: NVENC RFI was
transparent (no anchor tag) while the session glue armed the 750ms IDR cooldown,
so the freeze only lifted on the ~1s keyframe re-ask. NVENC now mirrors AMF —
`pending_anchor` tags the first post-invalidate AU (the clean re-anchor
P-frame) `recovery_anchor`, incl. the covering-range dedupe re-arm; the client
lifts at ~RTT.

F3 — speed-test probe filler burned video frame indexes: moved to its own index
space (`Packetizer::alloc_probe_index` + `Session::submit_probe_frame`) with a
second client reassembly window routed on FLAG_PROBE, gated on the new
VIDEO_CAP_PROBE_SEQ Hello bit (mid-session probes declined for older clients).

F4 — RFI range sanity cap: forward gaps wider than `packet::RFI_MAX_RANGE` (256)
resync via keyframe instead of an out-of-range RFI, host- and client-side
(client huge-gap → keyframe in `RfiRecovery::observe` + the pf-client-core pump).

F5 — reset() parity: Windows NVENC (teardown + lazy re-init), Linux VAAPI
(drop-inner), Linux NVENC (reopen from stored OpenArgs) now give the stall
watchdog a heal lever instead of ending the session.

F6 — sw.rs `pending: VecDeque` (was `Option`), killing the silent AU drop at
capturer pipeline depth > 1. F7 — doc sweep on the RFI/anchor comments.

Verified: punktfunk-core lib tests (macOS + Linux), full punktfunk-host suite on
Linux (RTX 5070 Ti), Windows compile. Owed: the on-glass client matrix (F2
freeze A/B, AMF LTR spike across a bitrate rebuild).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

include/punktfunk_core.h

@@ -274,6 +274,15 @@
 // `AV_FRAME_FLAG_KEY` — this host flag is the only signal.
 #define USER_FLAG_RECOVERY_ANCHOR 32
 
+// Widest lost-frame range (frames, wrapping `last - first`) a reference-frame-invalidation
+// recovery may be asked to repair; anything wider goes straight to the keyframe path on BOTH
+// ends. RFI can only re-reference history the encoder still holds — NVENC keeps a 5-frame DPB,
+// AMD LTR ~1 s of marks — and a genuine loss this wide (>1 s even at 240 fps) has no valid
+// reference anywhere, so an RFI request for it is either hopeless or (worse) a phantom range
+// from a desynced counter. Shared by the host's RFI dispatch (range → keyframe fallback) and the
+// client-side gap detectors (huge gap → resync + keyframe request, no RFI).
+#define RFI_MAX_RANGE 256
+
 // Largest UDP datagram the core will send or accept. `Config::validate` bounds
 // `shard_payload` so `HEADER_LEN + shard_payload + CRYPTO_OVERHEAD ≤ MAX_DATAGRAM_BYTES`.
 #define MAX_DATAGRAM_BYTES 2048
@@ -382,6 +391,21 @@
 #define VIDEO_CAP_HOST_TIMING 8
 #endif
 
+#if defined(PUNKTFUNK_FEATURE_QUIC)
+// [`Hello::video_caps`] bit: the client's reassembler keeps **speed-test probe filler in its own
+// frame-index space** (a second reassembly window keyed on the [`crate::packet::FLAG_PROBE`]
+// user-flag), so probe bursts no longer consume video `frame_index`es. Without this, a mid-session
+// speed test burns thousands of video indexes that are invisible to every client-side gap detector
+// (probe frames are filtered before the pump sees them) — the first real AU afterwards reads as a
+// phantom multi-thousand-frame loss (spurious freeze + a nonsense RFI). It also lets the host's
+// encode loop own the video numbering outright (the wire-index contract
+// [`crate::packet::Packetizer::packetize_each`] documents), which reference-frame invalidation
+// depends on. The host runs mid-session probe bursts ONLY against clients that set this bit — an
+// older client gets a declined (zeroed) [`ProbeResult`] instead of a measurement its single-window
+// reassembler would silently drop as stale.
+#define VIDEO_CAP_PROBE_SEQ 16
+#endif
+
 #if defined(PUNKTFUNK_FEATURE_QUIC)
 // QUIC application error code a punktfunk/1 client closes the control connection with on a
 // **deliberate quit** (a user "stop", not a network drop). The host reads it off the connection's