iter2 Fix 3: decoupled CAPTURE buffer pool with LRU recycling

Pre-iter2 each VA surface was permanently 1:1 bound to one V4L2 CAPTURE
buffer. mpv reusing a surface for a new decode while the compositor still
held an EXPBUF'd dma_buf fd to the prior frame caused the kernel to
write fresh decode output into the same physical memory the compositor
was reading -- visible as stutter / back-and-forth swap on
mpv --hwdec=vaapi --vo=gpu playback.

Architecture:
- New cap_pool abstraction (cap_pool.{h,c}) owns N CAPTURE buffers
  (N = max(surfaces_count, MIN_CAP_POOL=24)) with per-slot state
  {FREE, IN_DECODE, DECODED, EXPORTED} guarded by pthread_mutex_t.
- Surfaces no longer own buffers; each vaBeginPicture acquires the
  oldest FREE slot (LRU), binds it for the decode cycle, and the slot
  cycles IN_DECODE -> DECODED (post-DQBUF) -> EXPORTED (post-EXPBUF).
- Slot is released on next BeginPicture for the same surface or on
  vaDestroySurfaces.

Limitations (Sonnet Phase 5 review iter2 9.x, deferred to iter3+):
- Option-A statistical mitigation; race window narrows to "pool
  exhausted, force-recycle of oldest EXPORTED slot." For typical mpv
  16-surface playback with MIN_CAP_POOL=24 the fallback never fires.
- Multi-context concurrent use not addressed (one V4L2 device, multiple
  cap_pools -- iter3 scope).

Other call sites updated:
- picture.c::BeginPicture acquires + binds, releasing prior slot if any.
- surface.c::SyncSurface marks slot DECODED after DQBUF.
- surface.c::ExportSurfaceHandle marks slot EXPORTED, retaining OUR
  EXPBUF fd for force-recycle close().
- surface.c::DestroySurfaces releases via surface_unbind_slot;
  cap_pool owns the mmaps now.
- surface.c::CreateSurfaces2 destroys the pool in the resolution-change
  path before REQBUFS(0) (else stale v4l2_index after Fix 1's REQBUFS).
- context.c::DestroyContext invokes cap_pool_destroy.
- image.c::DeriveImage skips copy_surface_to_image when current_slot is
  NULL (ffmpeg av_hwframe_ctx_init probes derive on undecoded surfaces).

Verified: mpv vaapi-copy 200 frames bbb_1080p30, 0 drops, LRU visibly
recycling slot indices, real luma gradient. mpv vaapi --vo=gpu
operator-inspection follows.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/picture.c

@@ -235,6 +235,25 @@ VAStatus RequestBeginPicture(VADriverContextP context, VAContextID context_id,
 	if (surface_object->status == VASurfaceRendering)
 		RequestSyncSurface(context, surface_id);
 
+	/*
+	 * Iter2 Fix 3: acquire a CAPTURE-pool slot for this decode cycle.
+	 * If the surface still holds a slot from a prior decode (DECODED
+	 * or EXPORTED — the consumer is done with it by definition since
+	 * we got back to BeginPicture for the same surface), release it
+	 * first. The new slot is bound and its V4L2 index + mmap pointers
+	 * are mirrored into surface_object->destination_* so the existing
+	 * QBUF/DQBUF/EXPBUF code paths see no behavioral change.
+	 */
+	if (surface_object->current_slot != NULL)
+		surface_unbind_slot(driver_data, surface_object);
+	{
+		struct cap_pool_slot *cap_slot =
+			cap_pool_acquire(&driver_data->capture_pool, surface_id);
+		if (cap_slot == NULL)
+			return VA_STATUS_ERROR_ALLOCATION_FAILED;
+		surface_bind_slot(surface_object, cap_slot);
+	}
+
 	/*
 	 * Borrow an OUTPUT (bitstream-input) slot from the driver-wide
 	 * pool for the duration of this Begin/Render/End cycle. The