Merge main into dev - #61

…longer freezes the deck (StreamController#1)

The writer thread (sole path for paints/brightness/Clear/ClearAndClose
since the single-writer migration) ran unguarded: any uncaught exception
killed it, freezing the deck until replug while control_q grew unbounded.

run() now delegates to _run_one_tick() inside a guarded loop: a tick
exception is logged with full traceback (rate-limited to 1/5s with a
suppressed-repeat count -- local limiter until StreamController#91), _stop is honored in
the except path so a failing body can't strand close(), and a 0.25s
wake-event backoff bounds a persistent failure at ~4 retries/s instead of
a 100% spin. @log.catch on run() would log once and let the thread die --
the guard must live inside the while. Composes with StreamController#80: the hooks report
an escaping death; this prevents the death.

The five audit-verified crash vectors are also fixed at the source:
(a) init_inputs is build-then-swap and the screensaver drops its
`inputs = {}` pre-clear (was an empty-dict window on every screensaver
entry); the loop snapshots the dict once per tick and uses .get();
(b) the loop snapshots background.video once (set_video(None) race);
(c) touchscreen get_current_image guards a nulled active_page (blank
strip); (d) the touchscreen tick gate snapshots state.background_video
(_release_background_video race); (e) _exec_clear snapshots the
touchscreen slot and nulls it identity-compared -- the crash half of StreamController#1
and this site's half of StreamController#8.

tests/scenario_writer_survival.py (first leg of StreamController#61) runs the REAL loop
over the stub tier: survives a poisoned tick, resumes paints, caps the
log storm, and stop() joins while every tick raises. fixtures gains
_QuietInputState (get_active_state) since the live loop path never
executed on stubs before (StreamController#69 stub-drift). Suite: 34/34.

…rminal legs (StreamController#61)

scenario_tile_builder_terminal covered ONE B-02 terminal path (os.replace /
promote failure via a directory at the cache path) with a bounded join +
is_alive() exit assertion. The audit enumerates four sources of the terminal
state (cap released, _complete False); this adds the two that were missing,
restructured into the sub-leg pattern, sharing the join+is_alive detector:

  - writer-open failure: cv2.VideoWriter patched to a never-opened stub, so
    _open_source leaves _writer None and _end_of_source promotes nothing.
  - truncated source: a capture stub that opens and reports CAP_PROP_FRAME_COUNT
    60 but whose read() never succeeds (byte-truncating an mp4v file is
    all-or-nothing -- the moov atom is trailing -- so the metadata-over-promise
    is modelled at the capture seam). Zero frames written -> terminal.

The 'reopen failure' fourth path shares promote_failure's end-state and
terminal seam, covered transitively.

Red-proof: neutralizing _run_builder's is_build_terminal() check (the pre-fix
busy-spin, f881630 reverted) makes all three legs' builder threads outlive
the 8s bounded join -> FAIL on each. Full suite 100/100.

test(pages,media): page-cache eviction arithmetic + builder-spin terminal legs (StreamController#60, StreamController#61)

Closes StreamController#60 and StreamController#61

See merge request naz/StreamController!46