[AZ-662] [AZ-669] Close batch 19: green test gate via Jetson Docker

Stand up a production-target test runner on jetson-e2e and run the
deferred cargo test --workspace for batch 19.

Infra:
- Dockerfile.test: ubuntu:22.04 + libopencv-dev + libav*-dev +
  libclang-dev + protobuf-compiler + rust 1.82.0 (rustfmt, clippy).
  Sets LIBCLANG_PATH so clang-sys can dlopen libclang under the
  opencv-rust clang-runtime path.
- scripts/jetson-test.sh: rsync source to jetson-e2e, docker build,
  docker run cargo test --workspace --no-fail-fast.

Workspace fix exposed by the gate:
- Cargo.toml: enable opencv "clang-runtime" feature. Without it the
  workspace fails to build because clang-sys is shared between
  opencv-binding-generator and bindgen (via ffmpeg-sys-next) and the
  opencv generator panics with "a `libclang` shared library is not
  loaded on this thread" (opencv-rust GH issue #635).

Batch-19 code bugs exposed by the gate (6 compile errors + 1 algo bug):
- movement_detector::optical_flow: min_max_loc signature (opencv 0.98
  expects Option<&mut f64> / Option<&mut Point>); data_mut() returns
  *mut u8 directly, not Result. RANSAC residual now filters by the
  inlier mask returned by find_homography (matches the docstring; was
  systematically over-reporting motion magnitude on synthetic
  pure-pan input).
- semantic_analyzer::scoring::freshness: same data_mut() fix;
  stddev_f32 now takes &impl core::ToInputArray so it accepts the
  BoxedRef<Mat> that Mat::roi returns in opencv 0.98.

Result: 391 tests passed across 58 binaries, 0 in-scope failures.

Two pre-existing failures in frame_ingest (batch 16-18 scope) are
NOT addressed here and are recorded as leftovers:
- frame_ingest_cuvid_segv: HIGH severity production bug; libavcodec58
  advertises h264_cuvid but libnvcuvid.so.1 is missing at runtime, the
  software fallback never fires, first send_packet SEGVs.
- frame_ingest_publisher_timing_flake: LOW severity; Jetson-specific
  timing budget too tight for ac1_three_consumers_at_rate_lose_no_frames.

Neither blocks batch 20 (movement_detector / semantic_analyzer next).

Co-authored-by: Cursor <cursoragent@cursor.com>

Cargo.toml

@@ -87,15 +87,30 @@ libc = "0.2"
 # Geospatial
 h3o = "0.7"
 
-# Computer vision (movement_detector ego-motion + semantic_analyzer freshness scoring)
-opencv = { version = "0.98", default-features = false, features = ["calib3d", "imgproc", "video"] }
+# Computer vision (movement_detector ego-motion + semantic_analyzer freshness scoring).
+# `clang-runtime` is required because the workspace ALSO uses `bindgen`
+# (via `ffmpeg-sys-next`), and the opencv generator's static libclang
+# linkage conflicts with bindgen's clang-sys instance — symptom:
+# "a `libclang` shared library is not loaded on this thread" at build
+# time. See opencv-rust GH issue #635. The runtime feature switches
+# opencv-binding-generator to dlopen libclang via `LIBCLANG_PATH`,
+# resolving the conflict.
+opencv = { version = "0.98", default-features = false, features = ["calib3d", "imgproc", "video", "clang-runtime"] }
 
 # Graph data structures (semantic_analyzer primitive graph)
 petgraph = "0.8"
 
 # Multimedia (RTSP + H.264/265 decode for frame_ingest — see AZ-658).
-# Linked dynamically against the host FFmpeg 8.x install (libavcodec /
-# libavformat / libavutil / libswscale / libswresample) via pkg-config.
+# Linked dynamically against the host FFmpeg via pkg-config.
+# `ffmpeg-sys-next` performs compile-time FFmpeg version detection
+# (sets `ffmpeg_4_4` / `ffmpeg_5_x` / `ffmpeg_8_x` cfg flags
+# automatically — see crates.io README), so this single dep pin
+# compiles against FFmpeg 3.4 through 8.x. The production Jetson
+# target (JetPack 6 / Ubuntu 22.04) ships FFmpeg 4.4; the macOS
+# dev box typically has 6.x or 7.x via Homebrew. Default features
+# pull in: codec (libavcodec-dev), device (libavdevice-dev), filter
+# (libavfilter-dev), format (libavformat-dev), software-resampling
+# (libswresample-dev), software-scaling (libswscale-dev).
 ffmpeg-next = "8.1"
 
 # Test scaffolding