Hardware decode: VAAPI backend (Linux, HEVC + AV1, dlopen)

[justin13888]

• HwStillDecoder impl over libva, dlopen'd at runtime — absence of libva/device degrades to decoder() == None, never a link failure (headless-safe).
• HEVC Main/Main10: SPS/PPS/VPS from HevcConfig NAL arrays via NalUnitIter (or the upstream Annex-B helper, gamut-heic: Annex-B export helpers for platform hardware decoders gamut#255, if accepted); slice submission.
• AV1 Main profile: OBU submission from av1C + item payload.
• 8-bit (NV12) and 10-bit (P010) surfaces → DecodedFrame.
• NVIDIA supported via the nvidia-vaapi-driver translation layer — document status (see docs/SUPPORT.md NVDEC justification).
• Device-gated real-decode tests; graceful skip in CI without a device.
• Depends on: Create rawshift-hwdec (HEVC+AV1); HEIC on gamut-heic; drop libheif-rs #27.