DAEMON-PPS: synthesise H.264 SPS/PPS NAL units from V4L2 controls

libva-v4l2-request-fourier (and any V4L2-stateless-API consumer)
passes H.264 SPS/PPS as separate V4L2_CID_STATELESS_H264_{SPS,PPS}
controls; only the slice NAL goes into the OUTPUT buffer.  This is
correct per the V4L2 stateless contract.  But libavcodec — which
the daedalus daemon uses for actual decode (Option γ) — wants a
self-contained AnnexB stream including SPS+PPS before any slice.
Result on higgs: "non-existing PPS 0 referenced" + decode_slice_
header errors on every H.264 frame, even after LIBVA-1 and -2
routing correctly delivered the request to the daemon.

Fix splits across kernel + daemon, keeping the kernel module as a
thin transport and putting the actual NAL encoding in userspace:

  include/daedalus_v4l2_proto.h:
    Add struct daedalus_h264_meta (the four v4l2_ctrl_h264_*
    structs the kernel collects) and DAEDALUS_REQ_FLAG_H264_META
    (set in req.flags when the meta block is present between the
    daedalus_req_decode prefix and the slice bitstream).

  kernel/daedalus_v4l2_main.c:
    Add daedalus_collect_h264_meta() — reads the H.264 ctrl values
    from the bound media_request via v4l2_ctrl_find +
    ctrl->p_cur.p_h264_*.  device_run() calls it on H.264 codec_id,
    copies the structs into the REQ_DECODE payload between the
    prefix and bitstream, and sets the flag.  Payload size is
    bounds-checked against DAEDALUS_PROTO_MAX_PAYLOAD so an over-
    sized slice + meta fails loud instead of truncating.

  daemon/src/bitstream_writer.{c,h}:
    New module — MSB-first bit packer with H.264 Exp-Golomb ue(v)
    and se(v) coding + rbsp_trailing_bits alignment.  Sticky
    overflow flag so callers can verify the output buffer wasn't
    truncated.

  daemon/src/h264_nal_synth.{c,h}:
    New module — turns v4l2_ctrl_h264_sps / v4l2_ctrl_h264_pps
    into AnnexB-framed NAL units per ITU-T H.264 7.3.2.1 / 7.3.2.2.
    Emits emulation prevention bytes (0x03 after every 00 00 in the
    EBSP) and the 4-byte start code (0x00000001).  Coverage matches
    what V4L2 stateless surface gives us: VUI parameters and full
    scaling matrices are NOT emitted (V4L2 doesn't carry them — the
    seq_scaling_matrix_present_flag is set to 0 and libavcodec uses
    flat defaults, which matches the de-facto behaviour of most
    H.264 streams libva-v4l2-request drives).

  daemon/src/decoder.c:
    daedalus_decoder_run_request() now takes an optional
    h264_meta parameter.  For codec_id == H264 with meta != NULL,
    synthesises SPS+PPS NAL units, allocates a combined
    [SPS][PPS][slice] buffer (+ AV_INPUT_BUFFER_PADDING_SIZE), and
    feeds that to avcodec_send_packet instead of the raw slice.
    VP9/AV1 path unchanged (frames are self-contained).  Cleanup
    now goes through a unified `out:` label so the assembled
    buffer is always freed on every exit (including the existing
    decoder_open_codec / no-frame / receive_frame failure paths).

  daemon/src/chardev_client.c:
    handle_req_decode() peels off the optional meta block when the
    flag is set, passes it through to the decoder, and updates
    the payload-length consistency check (now allows for an extra
    sizeof(daedalus_h264_meta) when the flag is on).

Build (boltzmann aarch64): clean compile of all daemon sources,
including bitstream_writer + h264_nal_synth + the refactored
decoder.c.  Kernel module compile to be verified via DKMS rebuild
on higgs in the marfrit-packages bump that follows.

Test plan: with this commit + a marfrit-packages daedalus pin
bump, higgs's ffmpeg -hwaccel vaapi -i h264_test.mp4 should
produce a successful decode (vs. the previous "non-existing PPS 0
referenced" failure).  The daemon log should show:
  decoder: opened h264 context
  decoder: h264 prepended SPS=NB PPS=MB slice=KB
  decoder: OK 320x240 fmt=0 (yuv420p) fnv1a=0x...

VP9 / AV1 behaviour unchanged — they don't carry meta and the
existing per-frame self-describing path still applies.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

daemon/src/bitstream_writer.c

@@ -0,0 +1,101 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+#include "bitstream_writer.h"
+
+#include <string.h>
+
+void bsw_init(struct bs_writer *bs, uint8_t *buf, size_t cap)
+{
+	bs->buf = buf;
+	bs->cap = cap;
+	bs->pos_bytes = 0;
+	bs->pos_bit = 0;
+	bs->overflow = false;
+	if (buf && cap)
+		buf[0] = 0;
+}
+
+void bsw_put_u(struct bs_writer *bs, uint32_t v, int n)
+{
+	int i;
+
+	if (n <= 0 || n > 32)
+		return;
+
+	for (i = n - 1; i >= 0; i--) {
+		uint8_t bit = (uint8_t) ((v >> i) & 1u);
+
+		if (bs->pos_bytes >= bs->cap) {
+			bs->overflow = true;
+			return;
+		}
+
+		if (bs->pos_bit == 0)
+			bs->buf[bs->pos_bytes] = 0;
+
+		bs->buf[bs->pos_bytes] |= (uint8_t) (bit << (7 - bs->pos_bit));
+		bs->pos_bit++;
+		if (bs->pos_bit == 8) {
+			bs->pos_bit = 0;
+			bs->pos_bytes++;
+		}
+	}
+}
+
+/*
+ * Exp-Golomb ue(v) — H.264 9.1 / 9.1.1.
+ * For an unsigned value v:
+ *   codeNum = v
+ *   leadingZeroBits = floor(log2(codeNum + 1))
+ *   code = leadingZeroBits zeros, then '1', then leadingZeroBits bits
+ *          of (codeNum + 1 - 2^leadingZeroBits)
+ *
+ * Total length = 2 * leadingZeroBits + 1 bits.  For v = 0 the
+ * code is just "1" (1 bit).  For v in [1,2] the code is 3 bits, etc.
+ */
+void bsw_put_ue(struct bs_writer *bs, uint32_t v)
+{
+	uint32_t code_num = v;
+	uint32_t code_num_plus_1 = code_num + 1u;
+	int leading_zeros = 0;
+	uint32_t tmp;
+
+	tmp = code_num_plus_1 >> 1;
+	while (tmp) {
+		leading_zeros++;
+		tmp >>= 1;
+	}
+
+	/* leading_zeros zero bits */
+	bsw_put_u(bs, 0u, leading_zeros);
+	/* one '1' bit + the (leading_zeros) low bits of code_num_plus_1 */
+	bsw_put_u(bs, code_num_plus_1, leading_zeros + 1);
+}
+
+/*
+ * Exp-Golomb se(v) — H.264 9.1.1: signed mapping is interleaved:
+ *   0 -> 0, 1 -> 1, -1 -> 2, 2 -> 3, -2 -> 4, ...
+ * i.e. codeNum = 2 * |v| - (v > 0 ? 1 : 0).
+ */
+void bsw_put_se(struct bs_writer *bs, int32_t v)
+{
+	uint32_t code_num;
+
+	if (v > 0)
+		code_num = (uint32_t) (2 * v - 1);
+	else
+		code_num = (uint32_t) (-2 * v);
+	bsw_put_ue(bs, code_num);
+}
+
+void bsw_align_rbsp(struct bs_writer *bs)
+{
+	/* rbsp_stop_one_bit + zero-fill to byte boundary */
+	bsw_put_u(bs, 1u, 1);
+	while (bs->pos_bit != 0)
+		bsw_put_u(bs, 0u, 1);
+}
+
+size_t bsw_bytes(const struct bs_writer *bs)
+{
+	return bs->pos_bytes;
+}