fix(video): isolate optional Program publication (#804)

[iamfatness]

Refs #804.

Prepared Program frames previously expired while the delivery clock executed optional shell/multiview keyed copies and Flush calls. Move those exports to two independent device/context owners. Native delivery publishes the GPU-ready packet/PTS without D3D calls; each optional reader admits at most one immutable source lease, verifies actual GPU read completion before reuse, and refuses work while busy. Keep the two-frame setting and existing depth + 3 slot capacity.

The real shell snapshot and multiview PGM consumer now publish separately, preserving exact frame metadata and the existing stable output handles. Add bounded branch counters and separate acquire/copy/flush/query wall-time traces. GPU-query uncertainty quarantines a source lease and disables that reader. The fixed snapshot pool adds about 39.6 MiB at 1080p/two-frame buffering. Driver APIs that never return can still prevent teardown joining; no device recreation claim.

Validation: exact final head 197c8cd, Release build, full native suite 1,467 passed / 0 failed, including all seven Program-buffer tests. The deterministic fault blocks either optional exporter for about one second and verifies 60/60 native NV12 packets, sequence/pixel identity, zero active-workload underruns/overflows, bounded two-reader ownership, advancing actual GPU pixels in the other reader, and retained original pixels after the delayed read resumes. The unchanged full-size cadence test also passes. Original failed 23.654 ms publication trial remains retained.

Three matched inline/isolated pairs passed (120 measured seconds each, ten-second warmup, eight synthetic I420 1080p30 inputs plus 1080p/1440p BGRA captures, Program/Preview/MV 1080p60, buffer two, CPU preparation zero, local MP4). Across all six trials: 43,248 measured Program packets, zero Program underruns/delivery misses/output sequence gaps/skipped production slots/audio sample loss, and zero recorder missing frames/encoder video or audio queue drops/failures. Inline mean work was 4.600/4.615/4.676 ms; isolated 0.943/1.045/0.878 ms. All final-head CI and CodeQL checks passed, including Windows shell and production compile, Metal/full/stub/mac, TSan, unit/version and show drill.

These are synthetic aggregate results, not receiver/display, decoded A/V, real SDK/capture or installed/fleet qualification. Branch completion traces include warmup/tail and must not be equated with the measured interval or display consumption. All snapshots, stderr, MP4s, manifests and original failed trials remain private.

Default isolation/preparation flags and installed application are unchanged. Parent #517 receiver/display, A/V, long soak, installed/fleet and lifecycle qualification remain open. PR #808 stays draft while #804 is qualified; this branch is based on merged #806, independently of #808.