ampere-av1 Phase 2 (master): fourth-fd probe + AV1 enumeration

Imports the minimal "vainfo lists VAProfileAV1Profile0" layer from the
operator's in-progress av1-iter1 branch (Phase 2 steps 1, 2 — commits
bed75c0 + 61db76e on av1-iter1). The Phase 3-5 bit-exact decode-side
work stays in av1-iter1; this commit gives master the enumeration +
fd-routing layer so consumers (ffmpeg-vaapi, firefox-fourier, chromium-
fourier) at least see VAProfileAV1Profile0 today on RK3588.

What this commit adds:
- video_fd_vpu981 + media_fd_vpu981 slots to struct request_data
  (named to match av1-iter1's convention so the operator's Phase 3-5
   merge resolves cleanly)
- 4th-decoder probe loop in VA_DRIVER_INIT that walks hantro-vpu
  media nodes for an instance advertising V4L2_PIX_FMT_AV1_FRAME
  (AV1F) as OUTPUT pixfmt. RK3588 has 3 hantro-vpu instances all
  reporting driver="hantro-vpu" + model="hantro-vpu", so OUTPUT-
  format probe is the only DTS-independent discriminator.
- 'a' kind in request_device_kind_for_profile (VAProfileAV1Profile0)
  + 'a' branch in request_switch_device_for_profile.
- video_fd_vpu981 added to any_fd_supports_output_format helper
  (existing 3-slot loop missed the new fd; same off-by-one trap
  that bit ampere's av1-iter1 enumeration for a week).
- VAProfileAV1Profile0 → V4L2_PIX_FMT_AV1_FRAME in pixelformat_for
  _profile.
- VAProfileAV1Profile0 push in RequestQueryConfigProfiles +
  RequestQueryConfigEntrypoints + RequestCreateConfig switch.
- vpu981 fd cleanup in RequestTerminate.
- rpi_hevc_dec fd cleanup added at the same time (was already missing
  in master — fixed defensively).
- V4L2_REQUEST_MAX_PROFILES bumped 13 → 14. Defensively sized for
  the post-Option-B-revert future: with iter39 Option B reverted
  (Hi10P + Main10 back in enumeration) plus AV1, max possible
  enumeration is 13. The per-group guards use `index < MAX - N`
  pattern; for a singleton push to succeed at index=13 we need
  MAX >= 14. Bumping now avoids the same off-by-one bug from
  silently dropping AV1 when Option B eventually reverts.

What this commit does NOT add:
- av1.{c,h} decode-side scaffolding (Phase 2 step 4 on av1-iter1 —
  ~177 LoC including a stub av1_set_controls that returns -1). When
  the operator's av1-iter1 Phase 3-5 work lands on master, those
  500+ LoC + the stub will follow. Without them, consumers calling
  vaCreateContext(VAProfileAV1Profile0) succeed at the libva layer
  but ffmpeg-vaapi will fail at the first vaRenderPicture with an
  AV1-buffer-type rejection — clean error, no crash.

Verified 2026-05-18 on ampere:

  $ env LIBVA_DRIVER_NAME=v4l2_request vainfo | grep VAProfile
        ... (10 prior profiles, unchanged) ...
        VAProfileAV1Profile0            :   VAEntrypointVLD   ✓

  Probe log: "ampere-av1: vpu981 AV1 decoder at /dev/video4 + /dev/media3"

Build clean on ampere with GCC 16.1.1; no warnings introduced.
ampere's running module restored to the av1-iter1 build after the
verification — this commit's .so was NOT permanently installed.

Closes the headline acceptance criterion in
marfrit/libva-v4l2-request-fourier#2 ("vainfo on ampere lists
VAProfileAV1"). End-to-end AV1 decode bit-exactness is iter4 work
that the av1-iter1 branch continues to drive.

Co-Authored-By: claude-noether <claude-noether@reauktion.de>

src/request.h

@@ -42,7 +42,16 @@
 
 #define V4L2_REQUEST_STR_VENDOR			"v4l2-request"
 
-#define V4L2_REQUEST_MAX_PROFILES		13
+/*
+ * Sized for max-possible enumeration with iter39 Option B reverted:
+ * MPEG2(2) + H264(6 incl. Hi10P) + HEVC(2 incl. Main10) + VP8 + VP9 + AV1 = 13.
+ * The per-group guards use `if (... && index < (MAX_PROFILES - N))` where N
+ * is the push-group size, so MAX must be ≥ total+1 — 14 here. Bumping
+ * defensively now so a future re-enable of Hi10P/Main10 doesn't silently
+ * drop AV1 through the off-by-one trap that ate ampere-av1's enumeration
+ * for a week (see issue marfrit/libva-v4l2-request-fourier#2).
+ */
+#define V4L2_REQUEST_MAX_PROFILES		14
 #define V4L2_REQUEST_MAX_ENTRYPOINTS		5
 #define V4L2_REQUEST_MAX_CONFIG_ATTRIBUTES	10
 #define V4L2_REQUEST_MAX_IMAGE_FORMATS		10
@@ -87,6 +96,21 @@ struct request_data {
 	 */
 	int video_fd_rpi_hevc_dec;
 	int media_fd_rpi_hevc_dec;
+	/*
+	 * ampere-av1-enablement Phase 2: fourth multi-device-probe slot
+	 * for vpu981 (RK3588's dedicated AV1 hantro instance, kernel
+	 * card="rockchip,rk3588-av1-vpu-dec", driver name "hantro-vpu" —
+	 * shared with the legacy MPEG-2/VP8/H.264 hantro). Discriminated
+	 * by V4L2_PIX_FMT_AV1_FRAME (AV1F) OUTPUT-pixfmt capability since
+	 * the driver name alone is ambiguous on RK3588. Stays -1 on hosts
+	 * without the AV1 vpu-dec.
+	 *
+	 * Named "vpu981" for consistency with the in-progress av1-iter1
+	 * operator branch (Phase 3-5 bit-exact AV1 work — when that lands
+	 * these fields receive the actual decode dispatch wiring).
+	 */
+	int video_fd_vpu981;
+	int media_fd_vpu981;
 
 	/*
 	 * iter2 (ampere-kernel-decoders campaign) — per-fd probe result