Phase 8.4: daemon ↔ kernel decode round-trip (VP9 end-to-end)

Wires the Phase 8.3 FFmpeg loader through the Phase 8.2 chardev
bridge: kernel injects REQ_DECODE carrying a raw VP9 access unit,
daemon hands the bitstream to libavcodec via dlopen, sends
RESP_FRAME back with a content-dependent FNV-1a digest of the
decoded YUV planes. Pure CPU decode for now — Phase 8.5 swaps in
dmabuf + QPU dispatch.

Protocol (include/daedalus_v4l2_proto.h):
- New REQ_DECODE (kernel→daemon) and RESP_FRAME (daemon→kernel)
  message types, with fixed-size payload structs.
- New DAEDALUS_CODEC_VP9/AV1/H264 enum (wire-stable so 8.6's
  AV1+H.264 work doesn't move existing values).
- New DAEDALUS_DECODE_* status enum (OK / NO_FRAME / ERR_OPEN /
  ERR_SEND / ERR_RECV / ERR_CODEC).
- Converted the prior `enum daedalus_msg_type` to #defines —
  high-bit values exceed INT_MAX and tripped -Wpedantic on
  userspace; kernel uABI headers use the same idiom.

Kernel (kernel/daedalus_v4l2_chardev.c):
- New debugfs entry /sys/kernel/debug/daedalus_v4l2/test_decode:
  writing raw bitstream bytes wraps them in a REQ_DECODE
  (codec=VP9 for Phase 8.4) and enqueues with an
  auto-incrementing cookie.
- daedalus_chardev_write learned RESP_FRAME: parses the payload
  and emits a single pr_info line with decode metadata. Keeps
  existing PONG handling on the default arm.

Daemon (daemon/src/...):
- chardev_client.{c,h} — opens /dev/daedalus-v4l2, blocking read
  loop, single-buffer write() responses (kernel chardev has only
  .write, not .write_iter, so writev lands as -EINVAL —
  discovered the hard way during first run).
- decoder.{c,h} — lazily-opened AVCodecContext per codec, shared
  AVPacket/AVFrame pair, descriptor-driven plane walker
  (av_pix_fmt_desc_get) so the same hash path covers YUV420P,
  YUV422P, YUV444P, GBRP and other 8-bit planar layouts.
  Generalised after first run decoded testsrc as GBRP (71)
  rather than the assumed YUV420P.
- `daemon` command in main.c opens the chardev and runs the loop
  until SIGINT/SIGTERM. Cookie correlation handled end-to-end.
- ffmpeg_loader gained av_pix_fmt_desc_get (23 symbols total).

Build:
- CMakeLists adds chardev_client.c + decoder.c; explicit
  -I../include for the shared protocol header.
- Still -Wall -Wextra -Wpedantic clean.

Verification on hertz (Pi 5, 6.12.75+rpt-rpi-2712):

  $ ffmpeg ... -pix_fmt yuv420p -c:v libvpx-vp9 -frames:v 1 \
           -y /tmp/vp9_test.ivf
  $ python3 ... strip IVF framing → vp9_keyframe.bin (3268 B)

  $ sudo insmod kernel/daedalus_v4l2.ko
  $ daedalus_v4l2_daemon -v daemon &
  $ sudo dd if=vp9_keyframe.bin \
         of=/sys/kernel/debug/daedalus_v4l2/test_decode

  daemon: REQ_DECODE cookie=2 → decoded yuv420p 320x240
          fnv1a=0x6ef10d71 luma=76800 chroma=38400
  kernel: RESP_FRAME cookie=2 status=0 320x240 pixfmt=0
          fnv1a=0x6ef10d71  ← matches daemon ✓

Hash properties verified:
  cookie=2  testsrc 3268 B → 0x6ef10d71  (first decode)
  cookie=3  red     44 B   → 0x7f6e5dc5  (content-dependent ✓)
  cookie=4  testsrc 3268 B → 0x6ef10d71  (deterministic ✓)
  cookie=5  64 B random    → status=101  (ERR_SEND, daemon alive)

Daemon survives bad input (FFmpeg "Invalid sync code" wrapped
into structured ERR_SEND response). Clean SIGTERM shutdown,
clean rmmod.

Phase 8.4 acceptance criteria met:
- ✓ end-to-end kernel→daemon→FFmpeg→kernel round-trip
- ✓ cookie correlation per request/response pair
- ✓ content-dependent + deterministic digest
- ✓ structured error responses (no daemon crash on bad input)
- ✓ clean teardown (SIGTERM + rmmod)
- ✓ builds clean on both kernel kbuild and daemon CMake

Per correctness-before-speed:
- Real chardev I/O (no shortcuts, no select-loop hacks)
- Real FFmpeg AVCodecContext lifecycle (lazily opened, properly
  freed on cleanup)
- Descriptor-driven plane walk (generalises across pix_fmts)
- Structured error path (not just log-and-continue)
- All resource paths cleaned up on every error branch
- Documented why FNV-1a digest, why write() not writev(), why
  pix_desc walk in docs/phase_8_4_closure.md

Phase 8.5 next: V4L2 m2m queue submits REQ_DECODE from
vidioc_qbuf; dmabuf carries actual pixel data so the chardev's
64 KiB cap doesn't gate frame size; begin substituting
daedalus_dispatch_* into the daemon's decode path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

daemon/src/decoder.h

@@ -0,0 +1,70 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*
+ * decoder.h — FFmpeg-driven decode helper for daedalus-v4l2 daemon.
+ *
+ * Encapsulates the AVCodecContext per supported codec, plus a
+ * single shared AVPacket / AVFrame pair (we serialise decode
+ * inside the chardev event loop; no concurrency).
+ *
+ * Phase 8.4 implements VP9.  Phase 8.6 extends to AV1 / H.264.
+ */
+#ifndef DAEDALUS_V4L2_DECODER_H
+#define DAEDALUS_V4L2_DECODER_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "daedalus_v4l2_proto.h"
+
+struct ffmpeg_loader;
+struct AVCodecContext;
+struct AVPacket;
+struct AVFrame;
+
+/**
+ * struct daedalus_decoder - per-daemon decoder state
+ * @loader:	borrowed FFmpeg loader (must outlive the decoder)
+ * @ctx_vp9:	lazily-opened VP9 AVCodecContext (NULL until first
+ *		VP9 REQ_DECODE)
+ * @pkt:	shared AVPacket reused across requests
+ * @frame:	shared AVFrame reused across requests
+ */
+struct daedalus_decoder {
+	struct ffmpeg_loader	*loader;
+	struct AVCodecContext	*ctx_vp9;
+	struct AVPacket		*pkt;
+	struct AVFrame		*frame;
+};
+
+/**
+ * daedalus_decoder_init - allocate the shared packet/frame pair
+ *
+ * Return: 0 on success, -ENOMEM if FFmpeg refused to allocate.
+ * Codec contexts are opened lazily on first use.
+ */
+int  daedalus_decoder_init(struct daedalus_decoder *dec,
+			   struct ffmpeg_loader *loader);
+
+/**
+ * daedalus_decoder_cleanup - free codec contexts, packet, frame
+ */
+void daedalus_decoder_cleanup(struct daedalus_decoder *dec);
+
+/**
+ * daedalus_decoder_run_request - decode one REQ_DECODE payload
+ * @dec:	initialised decoder
+ * @req:	REQ_DECODE prefix (from the wire)
+ * @bitstream:	bitstream blob (req->bitstream_len bytes)
+ * @resp:	caller-allocated RESP_FRAME output (zeroed by callee)
+ *
+ * Populates @resp with the decode outcome.  Always returns 0;
+ * decode-level failures are reported via @resp->status so the
+ * kernel sees a structured response rather than a dropped
+ * request.
+ */
+int  daedalus_decoder_run_request(struct daedalus_decoder *dec,
+				  const struct daedalus_req_decode *req,
+				  const uint8_t *bitstream,
+				  struct daedalus_resp_frame *resp);
+
+#endif /* DAEDALUS_V4L2_DECODER_H */