fix(motion): fence cross-process author frames

[appergb]

Summary

• replace heuristic Chromium surface priming with three author-owned OOPIF paint generations
• require each root readback to contain both the author marker and host guard, then reconstruct every pixel from two exact unmasked samples
• fail closed on marker tampering/reinsertion and stream 4K comparisons to keep memory bounded

Regression

Merged-main Windows CI exposed a stale OOPIF surface: 1152 differing channels = the exact 24x16 RGB author box. The old host-only guard could commit while the parent still embedded the pre-seek author surface.

Verification

• opentake-motion lib: 92/92
• Chromium live integration: 6/6, including 4K
• focused live exact author pixels/tamper test: PASS
• pipeline: 3/3
• clippy -D warnings, fmt, diff check: PASS
• independent Rust review: APPROVED