DAEMON-PPS: synthesise H.264 SPS/PPS NAL units from V4L2 controls

libva-v4l2-request-fourier (and any V4L2-stateless-API consumer)
passes H.264 SPS/PPS as separate V4L2_CID_STATELESS_H264_{SPS,PPS}
controls; only the slice NAL goes into the OUTPUT buffer.  This is
correct per the V4L2 stateless contract.  But libavcodec — which
the daedalus daemon uses for actual decode (Option γ) — wants a
self-contained AnnexB stream including SPS+PPS before any slice.
Result on higgs: "non-existing PPS 0 referenced" + decode_slice_
header errors on every H.264 frame, even after LIBVA-1 and -2
routing correctly delivered the request to the daemon.

Fix splits across kernel + daemon, keeping the kernel module as a
thin transport and putting the actual NAL encoding in userspace:

  include/daedalus_v4l2_proto.h:
    Add struct daedalus_h264_meta (the four v4l2_ctrl_h264_*
    structs the kernel collects) and DAEDALUS_REQ_FLAG_H264_META
    (set in req.flags when the meta block is present between the
    daedalus_req_decode prefix and the slice bitstream).

  kernel/daedalus_v4l2_main.c:
    Add daedalus_collect_h264_meta() — reads the H.264 ctrl values
    from the bound media_request via v4l2_ctrl_find +
    ctrl->p_cur.p_h264_*.  device_run() calls it on H.264 codec_id,
    copies the structs into the REQ_DECODE payload between the
    prefix and bitstream, and sets the flag.  Payload size is
    bounds-checked against DAEDALUS_PROTO_MAX_PAYLOAD so an over-
    sized slice + meta fails loud instead of truncating.

  daemon/src/bitstream_writer.{c,h}:
    New module — MSB-first bit packer with H.264 Exp-Golomb ue(v)
    and se(v) coding + rbsp_trailing_bits alignment.  Sticky
    overflow flag so callers can verify the output buffer wasn't
    truncated.

  daemon/src/h264_nal_synth.{c,h}:
    New module — turns v4l2_ctrl_h264_sps / v4l2_ctrl_h264_pps
    into AnnexB-framed NAL units per ITU-T H.264 7.3.2.1 / 7.3.2.2.
    Emits emulation prevention bytes (0x03 after every 00 00 in the
    EBSP) and the 4-byte start code (0x00000001).  Coverage matches
    what V4L2 stateless surface gives us: VUI parameters and full
    scaling matrices are NOT emitted (V4L2 doesn't carry them — the
    seq_scaling_matrix_present_flag is set to 0 and libavcodec uses
    flat defaults, which matches the de-facto behaviour of most
    H.264 streams libva-v4l2-request drives).

  daemon/src/decoder.c:
    daedalus_decoder_run_request() now takes an optional
    h264_meta parameter.  For codec_id == H264 with meta != NULL,
    synthesises SPS+PPS NAL units, allocates a combined
    [SPS][PPS][slice] buffer (+ AV_INPUT_BUFFER_PADDING_SIZE), and
    feeds that to avcodec_send_packet instead of the raw slice.
    VP9/AV1 path unchanged (frames are self-contained).  Cleanup
    now goes through a unified `out:` label so the assembled
    buffer is always freed on every exit (including the existing
    decoder_open_codec / no-frame / receive_frame failure paths).

  daemon/src/chardev_client.c:
    handle_req_decode() peels off the optional meta block when the
    flag is set, passes it through to the decoder, and updates
    the payload-length consistency check (now allows for an extra
    sizeof(daedalus_h264_meta) when the flag is on).

Build (boltzmann aarch64): clean compile of all daemon sources,
including bitstream_writer + h264_nal_synth + the refactored
decoder.c.  Kernel module compile to be verified via DKMS rebuild
on higgs in the marfrit-packages bump that follows.

Test plan: with this commit + a marfrit-packages daedalus pin
bump, higgs's ffmpeg -hwaccel vaapi -i h264_test.mp4 should
produce a successful decode (vs. the previous "non-existing PPS 0
referenced" failure).  The daemon log should show:
  decoder: opened h264 context
  decoder: h264 prepended SPS=NB PPS=MB slice=KB
  decoder: OK 320x240 fmt=0 (yuv420p) fnv1a=0x...

VP9 / AV1 behaviour unchanged — they don't carry meta and the
existing per-frame self-describing path still applies.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

daemon/src/bitstream_writer.h

@@ -0,0 +1,54 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*
+ * bitstream_writer.h — MSB-first bit packer with Exp-Golomb coding.
+ *
+ * Used by h264_nal_synth to emit AnnexB SPS / PPS NAL units the
+ * daemon prepends to libva-provided slice data before feeding
+ * libavcodec.  The writer is the minimum primitives the H.264
+ * SPS/PPS RBSPs need:
+ *
+ *   put_u(v, n)   — n-bit unsigned, MSB first
+ *   put_ue(v)     — Exp-Golomb unsigned (CAVLC ue(v))
+ *   put_se(v)     — Exp-Golomb signed   (CAVLC se(v))
+ *   align()       — rbsp_trailing_bits: stop_one + zero-pad to byte
+ *
+ * No allocations — the caller hands in a fixed buffer and the writer
+ * tracks (byte, bit) cursor in it.  Overruns are detected and made
+ * sticky via an error flag; callers check bsw_overflowed at the end.
+ */
+#ifndef DAEDALUS_BITSTREAM_WRITER_H
+#define DAEDALUS_BITSTREAM_WRITER_H
+
+#include <stddef.h>
+#include <stdint.h>
+#include <stdbool.h>
+
+struct bs_writer {
+	uint8_t *buf;
+	size_t cap;
+	size_t pos_bytes;
+	int pos_bit;     /* 0..7, MSB-first within the current byte */
+	bool overflow;
+};
+
+void bsw_init(struct bs_writer *bs, uint8_t *buf, size_t cap);
+void bsw_put_u(struct bs_writer *bs, uint32_t v, int n);
+void bsw_put_ue(struct bs_writer *bs, uint32_t v);
+void bsw_put_se(struct bs_writer *bs, int32_t v);
+
+/* Align to next byte boundary by appending rbsp_trailing_bits:
+ * a single '1' followed by '0's up to the byte boundary.  After
+ * this call bsw_bytes is the RBSP length. */
+void bsw_align_rbsp(struct bs_writer *bs);
+
+/* Byte count of payload written so far.  If pos_bit != 0, returns
+ * pos_bytes (incomplete bits are not counted; finalise with
+ * bsw_align_rbsp first). */
+size_t bsw_bytes(const struct bs_writer *bs);
+
+static inline bool bsw_overflowed(const struct bs_writer *bs)
+{
+	return bs->overflow;
+}
+
+#endif /* DAEDALUS_BITSTREAM_WRITER_H */