DAEMON-PPS: synthesise H.264 SPS/PPS NAL units from V4L2 controls

libva-v4l2-request-fourier (and any V4L2-stateless-API consumer)
passes H.264 SPS/PPS as separate V4L2_CID_STATELESS_H264_{SPS,PPS}
controls; only the slice NAL goes into the OUTPUT buffer.  This is
correct per the V4L2 stateless contract.  But libavcodec — which
the daedalus daemon uses for actual decode (Option γ) — wants a
self-contained AnnexB stream including SPS+PPS before any slice.
Result on higgs: "non-existing PPS 0 referenced" + decode_slice_
header errors on every H.264 frame, even after LIBVA-1 and -2
routing correctly delivered the request to the daemon.

Fix splits across kernel + daemon, keeping the kernel module as a
thin transport and putting the actual NAL encoding in userspace:

  include/daedalus_v4l2_proto.h:
    Add struct daedalus_h264_meta (the four v4l2_ctrl_h264_*
    structs the kernel collects) and DAEDALUS_REQ_FLAG_H264_META
    (set in req.flags when the meta block is present between the
    daedalus_req_decode prefix and the slice bitstream).

  kernel/daedalus_v4l2_main.c:
    Add daedalus_collect_h264_meta() — reads the H.264 ctrl values
    from the bound media_request via v4l2_ctrl_find +
    ctrl->p_cur.p_h264_*.  device_run() calls it on H.264 codec_id,
    copies the structs into the REQ_DECODE payload between the
    prefix and bitstream, and sets the flag.  Payload size is
    bounds-checked against DAEDALUS_PROTO_MAX_PAYLOAD so an over-
    sized slice + meta fails loud instead of truncating.

  daemon/src/bitstream_writer.{c,h}:
    New module — MSB-first bit packer with H.264 Exp-Golomb ue(v)
    and se(v) coding + rbsp_trailing_bits alignment.  Sticky
    overflow flag so callers can verify the output buffer wasn't
    truncated.

  daemon/src/h264_nal_synth.{c,h}:
    New module — turns v4l2_ctrl_h264_sps / v4l2_ctrl_h264_pps
    into AnnexB-framed NAL units per ITU-T H.264 7.3.2.1 / 7.3.2.2.
    Emits emulation prevention bytes (0x03 after every 00 00 in the
    EBSP) and the 4-byte start code (0x00000001).  Coverage matches
    what V4L2 stateless surface gives us: VUI parameters and full
    scaling matrices are NOT emitted (V4L2 doesn't carry them — the
    seq_scaling_matrix_present_flag is set to 0 and libavcodec uses
    flat defaults, which matches the de-facto behaviour of most
    H.264 streams libva-v4l2-request drives).

  daemon/src/decoder.c:
    daedalus_decoder_run_request() now takes an optional
    h264_meta parameter.  For codec_id == H264 with meta != NULL,
    synthesises SPS+PPS NAL units, allocates a combined
    [SPS][PPS][slice] buffer (+ AV_INPUT_BUFFER_PADDING_SIZE), and
    feeds that to avcodec_send_packet instead of the raw slice.
    VP9/AV1 path unchanged (frames are self-contained).  Cleanup
    now goes through a unified `out:` label so the assembled
    buffer is always freed on every exit (including the existing
    decoder_open_codec / no-frame / receive_frame failure paths).

  daemon/src/chardev_client.c:
    handle_req_decode() peels off the optional meta block when the
    flag is set, passes it through to the decoder, and updates
    the payload-length consistency check (now allows for an extra
    sizeof(daedalus_h264_meta) when the flag is on).

Build (boltzmann aarch64): clean compile of all daemon sources,
including bitstream_writer + h264_nal_synth + the refactored
decoder.c.  Kernel module compile to be verified via DKMS rebuild
on higgs in the marfrit-packages bump that follows.

Test plan: with this commit + a marfrit-packages daedalus pin
bump, higgs's ffmpeg -hwaccel vaapi -i h264_test.mp4 should
produce a successful decode (vs. the previous "non-existing PPS 0
referenced" failure).  The daemon log should show:
  decoder: opened h264 context
  decoder: h264 prepended SPS=NB PPS=MB slice=KB
  decoder: OK 320x240 fmt=0 (yuv420p) fnv1a=0x...

VP9 / AV1 behaviour unchanged — they don't carry meta and the
existing per-frame self-describing path still applies.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

include/daedalus_v4l2_proto.h

@@ -25,6 +25,7 @@
 #define DAEDALUS_V4L2_PROTO_H
 
 #include <linux/types.h>
+#include <linux/v4l2-controls.h>
 
 #define DAEDALUS_PROTO_MAGIC		0x44303456u	/* 'D04V' */
 #define DAEDALUS_PROTO_VERSION		0u		/* pre-1.0 */
@@ -90,10 +91,22 @@ enum daedalus_codec_id {
 	DAEDALUS_CODEC_H264	= 3,
 };
 
+/**
+ * DAEDALUS_REQ_FLAG_H264_META - daedalus_req_decode.flags bit
+ *
+ * Set when a struct daedalus_h264_meta is present between the
+ * daedalus_req_decode prefix and the slice bitstream.  Required for
+ * H.264 (codec_id == DAEDALUS_CODEC_H264) since libavcodec needs
+ * SPS/PPS that the V4L2 stateless API delivers as separate ctrls,
+ * not in the OUTPUT buffer.  Other codecs ignore this bit.
+ */
+#define DAEDALUS_REQ_FLAG_H264_META	0x00000001u
+
 /**
  * struct daedalus_req_decode - REQ_DECODE payload prefix
  * @codec_id:		enum daedalus_codec_id
  * @bitstream_len:	bytes of bitstream following this struct
+ *			(after any optional metadata blocks — see flags)
  * @capture_width:	CAPTURE buffer width in pixels
  * @capture_height:	CAPTURE buffer height in pixels
  * @capture_pix_fmt:	V4L2 fourcc of the CAPTURE format
@@ -103,10 +116,17 @@ enum daedalus_codec_id {
  * @capture_plane_size:	per-plane sizeimage from V4L2 S_FMT
  *			(plane[0..N-1]).  Unused entries = 0.
  * @capture_plane_stride: per-plane bytesperline from V4L2 S_FMT.
- * @flags:		reserved, must be zero
+ * @flags:		bitmask of DAEDALUS_REQ_FLAG_*
  *
- * Total payload_len for a REQ_DECODE = sizeof(struct
- * daedalus_req_decode) + bitstream_len.
+ * Wire layout for a REQ_DECODE payload:
+ *
+ *   struct daedalus_req_decode req;
+ *   IF (req.flags & DAEDALUS_REQ_FLAG_H264_META):
+ *     struct daedalus_h264_meta meta;
+ *   u8 bitstream[req.bitstream_len];
+ *
+ * Total payload_len = sizeof(req) + (meta ? sizeof(meta) : 0)
+ *                                  + req.bitstream_len.
  *
  * The daemon uses (capture_*) to fetch + mmap the right CAPTURE
  * plane via DAEDALUS_IOC_GET_DMABUF, then decodes pixels
@@ -124,6 +144,32 @@ struct daedalus_req_decode {
 	__u32 flags;
 };
 
+/**
+ * struct daedalus_h264_meta - H.264 stateless-decode metadata
+ *
+ * Optional block following the daedalus_req_decode prefix when
+ * DAEDALUS_REQ_FLAG_H264_META is set in req.flags.  Carries the
+ * structured controls the kernel collected from
+ * V4L2_CID_STATELESS_H264_* — the daemon converts them into
+ * AnnexB SPS+PPS NAL units (via an Exp-Golomb writer) and
+ * prepends those NAL units to the slice bitstream before
+ * handing it to libavcodec.
+ *
+ * The kernel never inspects these fields beyond capturing them
+ * verbatim from the v4l2_ctrl_handler at device_run time; the
+ * field semantics are governed entirely by the linux uABI
+ * V4L2 stateless H.264 control definitions.
+ *
+ * Wire-stable across phases.  If the kernel V4L2 H.264 control
+ * structs grow new fields the protocol version bumps with them.
+ */
+struct daedalus_h264_meta {
+	struct v4l2_ctrl_h264_sps		sps;
+	struct v4l2_ctrl_h264_pps		pps;
+	struct v4l2_ctrl_h264_scaling_matrix	scaling_matrix;
+	struct v4l2_ctrl_h264_decode_params	decode_params;
+};
+
 /**
  * enum daedalus_decode_status - RESP_FRAME outcome codes
  * @DAEDALUS_DECODE_OK:		frame produced; fields below populated