feat(mlt): provide verified audio-free FFV1 lossless profile for native A/V mux

[seradotcom]

Semwright #253 — exact, opt-in video-only MLT lossless profile

This upstream change unblocks source-bound multisegment H.264/AAC delivery from Motionwright without a shadow renderer, arbitrary FFmpeg shell route, fabricated PCM silence or a Broker approval bypass. It is additive to Semwright v1.0.0 contracts.

New closed profile

• lossless-video-only uses the existing managed semantic render.plan → render.start → render.status → render.result Host lane and the curated MLT avformat consumer with an=1, ffv1, Matroska.
• The original lossless profile still produces FFV1 + PCM s16le; H.264/AAC and audio-wav profiles are unchanged. RenderProfile.audio_codec is now optional, projecting null for the new profile in the shared RenderPreset contract (which explicitly allows video-only presets). No generic codec/command arguments are exposed.
• Post-render validation refuses any audio stream, non-FFV1/extra streams, changed width/height, invalid timeline clock. The Host-owned FFprobe independently decodes and counts all video frames with -count_frames; absent Matroska nb_frames never substitutes for observed frames. Only an exact 1–36,000 count passes.
• Existing output-root-only exclusive publication, byte cap, exact input project revision, Brokering, pinned executable supervision and cancellation/unknown outcome behavior remain in force. Decoder logs and private paths are not returned to the product.

Evidence

• Pure Rust regressions: original/opt-in output argv, semantic projection, PCM/audio presence, wrong codecs/size/FPS and invalid/missing/excessive decoded counts.
• Real Host/Bubblewrap Linux MLT E2E now renders lossless (audio present) and lossless-video-only (audio absent) against the same 50-frame audio-bearing semantic project. Provider receipts plus an independent host FFprobe call require 50 actually decoded FFV1 frames and exactly one stream. Existing H.264/AV tests remain active.
• Local lightweight cargo fmt --all -- --check and git diff --check PASSED; heavy Rust Clippy/unit and Host E2E are delegated to GitHub Actions and must be GREEN at this exact head before merge.

Boundaries

Source branch is isolated from the user's modified Semwright checkout; no other worktree or file deleted. This PR is not yet a Motionwright final H.264/AAC master, user approval, audio mix or permission to auto-close MLT projects. The consumer app must later review/re-pin the exact resulting Semwright SHA and pass its own independent native end-to-end mux acceptance. See seradotcom/motionwright#93 and seradotcom/motionwright#91.