macOS: convert VideoToolbox frames instead of dropping blocked output

[asayed18]

Stacked on #7. Retarget to main after #7 merges.

Problem

VLC on macOS decodes with VideoToolbox, so icop received opaque CVPX frames. There is no CVPX backend, so icop used the opaque fallback:

• Blocked frames were dropped, so the user saw a black screen instead of blur or warning.
• The debug overlay never rendered.
• Analysis ran synchronously on the video thread and held decoder buffers, so VideoToolbox stalled (pic_holder_wait timed out, many "picture is too late").

Fix

nsfw_backend_open now declines CVPX input. VLC's chain filter then inserts its cvpx converter and reopens icop with I420, which runs the normal CPU path: async worker, block styles and overlay. This uses VLC's existing fallback (filter_chain_AppendInner → chain → BuildFilterChain) and doesn't depend on any private VLC structs.

It is fail-closed. icop only declines when module_exists("cvpx") is true. Without that converter VLC would drop icop from the chain and play unfiltered, so in that case the old opaque fallback is kept.

The macOS smoke test now fails if the log says blocked frames would be dropped.

Verification (VLC 3.0.23, Apple Silicon, 1080p clip, hardware decoding on)

Run	Decoder stalls	Late frames	Blocked output
Before (30 s)	2–138	89–138	dropped (black)
After (~95 s)	0	32	blur drawn, overlay visible

• macos_vlc_smoke_test.sh passes on the installed build and logs declining VideoToolbox chroma CVPN → video backend=cpu input=I420.
• Not addressed here: the software path logs VLC's "Unsupported timestamp modifications done by chain_interactive" warning. This was already the case before this change, and it comes from icop holding frames before output.

🤖 Generated with Claude Code

[asayed18]

Added 446b611: several ONNX threads when icop runs a single detector worker.

Every ONNX session was pinned to SetIntraOpNumThreads(1). CoreML on macOS runs a single worker, so marqo needed ~120 ms per inference. With the automatic stride (every 3rd frame) a 720p30 video needed more than 1 s of inference per second of video and fell steadily behind. The plugin now exports NSFW_ONNX_INTRA_OP_THREADS = cores / workers (1–4) unless the user set it.

30 s run, VLC 3.0.23, Apple Silicon (8P+2E)	Late frames	Median late	Max late
720p30, before	380	3542 ms	8740 ms
720p30, after	5	37 ms	45 ms
1080p, after	1	22 ms	22 ms

marqo ORT benchmark: 1 thread 122 ms → 4 threads 37 ms. Moving marqo onto CoreML (fixed shape + MLProgram, 591/604 nodes) gave no speedup over the multi-threaded CPU, so that isn't included.