iter5 Track E: move LAST_OUTPUT_WIDTH/HEIGHT from process-global to per-driver-data

Sonnet review 7.3 / 9.6 from iter1 + carried iter2/3/4 substrate.
Two libva driver_data instances in the same process (e.g. Firefox
playing two tabs at different resolutions, or Firefox + mpv via the
same dlopened backend) would race on the static cache.

Move to struct request_data.last_output_width/height. The V4L2
device fd is already per-driver_data, so this is the correct binding
unit (one fd, one current OUTPUT format).

Verified: two concurrent mpv processes (2s stagger) both decode
300 frames cleanly with no cross-corruption. Same-instant init still
hits kernel-level fd contention on /dev/video1 (hantro is a
single-instance device); cross-process serialization is out of scope
for a libva backend.

Resolves the surface_reset_format_cache() callsite: now takes
driver_data parameter (was zero-arg).

Also drops the 'rc' unused-variable warning in v4l2_ioctl_controls
that the iter5 sweep left behind.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/surface.h

@@ -162,12 +162,10 @@ VAStatus RequestExportSurfaceHandle(VADriverContextP context,
  * has reset to defaults, our subsequent G_FMT returns 48x48, and the
  * exported descriptor encodes wrong pitch/offset.
  *
- * Limitation (Sonnet Phase 5 review 7.3 / 9.6): the cache is a
- * static process-global, so concurrent multi-context use still races.
- * Iteration 2 only addresses sequential sessions. Multi-context
- * safety is iteration 3+ scope.
+ * Iter5 Track E: cache lives per-driver_data (request_data.last_output_*),
+ * resolving the Sonnet review 7.3 / 9.6 multi-context race.
  */
-void surface_reset_format_cache(void);
+void surface_reset_format_cache(struct request_data *driver_data);
 
 /*
  * Iter2 Fix 3: bind / unbind a CAPTURE-pool slot to an object_surface.