[AZ-662] [AZ-669] Close batch 19: green test gate via Jetson Docker

Stand up a production-target test runner on jetson-e2e and run the
deferred cargo test --workspace for batch 19.

Infra:
- Dockerfile.test: ubuntu:22.04 + libopencv-dev + libav*-dev +
  libclang-dev + protobuf-compiler + rust 1.82.0 (rustfmt, clippy).
  Sets LIBCLANG_PATH so clang-sys can dlopen libclang under the
  opencv-rust clang-runtime path.
- scripts/jetson-test.sh: rsync source to jetson-e2e, docker build,
  docker run cargo test --workspace --no-fail-fast.

Workspace fix exposed by the gate:
- Cargo.toml: enable opencv "clang-runtime" feature. Without it the
  workspace fails to build because clang-sys is shared between
  opencv-binding-generator and bindgen (via ffmpeg-sys-next) and the
  opencv generator panics with "a `libclang` shared library is not
  loaded on this thread" (opencv-rust GH issue #635).

Batch-19 code bugs exposed by the gate (6 compile errors + 1 algo bug):
- movement_detector::optical_flow: min_max_loc signature (opencv 0.98
  expects Option<&mut f64> / Option<&mut Point>); data_mut() returns
  *mut u8 directly, not Result. RANSAC residual now filters by the
  inlier mask returned by find_homography (matches the docstring; was
  systematically over-reporting motion magnitude on synthetic
  pure-pan input).
- semantic_analyzer::scoring::freshness: same data_mut() fix;
  stddev_f32 now takes &impl core::ToInputArray so it accepts the
  BoxedRef<Mat> that Mat::roi returns in opencv 0.98.

Result: 391 tests passed across 58 binaries, 0 in-scope failures.

Two pre-existing failures in frame_ingest (batch 16-18 scope) are
NOT addressed here and are recorded as leftovers:
- frame_ingest_cuvid_segv: HIGH severity production bug; libavcodec58
  advertises h264_cuvid but libnvcuvid.so.1 is missing at runtime, the
  software fallback never fires, first send_packet SEGVs.
- frame_ingest_publisher_timing_flake: LOW severity; Jetson-specific
  timing budget too tight for ac1_three_consumers_at_rate_lose_no_frames.

Neither blocks batch 20 (movement_detector / semantic_analyzer next).

Co-authored-by: Cursor <cursoragent@cursor.com>

Dockerfile.test

@@ -0,0 +1,80 @@
+# Test image for the autopilot workspace.
+#
+# Mirrors the production target (Jetson Orin Nano Super, JetPack 6, Ubuntu
+# 22.04 LTS aarch64, FFmpeg 4.4, OpenCV 4.8) — see deploy/jetson/README.md.
+# `ffmpeg-sys-next 8.1` performs compile-time FFmpeg version detection
+# (sets `ffmpeg_4_4` cfg automatically), so the workspace's `ffmpeg-next
+# = "8.1"` pin works against Ubuntu 22.04's FFmpeg 4.4 with no code
+# change.
+#
+# Build (on the Jetson):
+#   docker build -t autopilot-test -f Dockerfile.test .
+#
+# Run (mount the source so `target/` is cached across runs):
+#   docker run --rm -v "$PWD:/workspace" -w /workspace autopilot-test
+#
+# Override the command for ad-hoc work:
+#   docker run --rm -it -v "$PWD:/workspace" -w /workspace autopilot-test \
+#     cargo test --workspace --no-fail-fast --color always
+#
+# First build (cold apt + rustup): ~10-20 min on Jetson Orin Nano Super.
+# Subsequent builds (only Cargo.toml / sources changed): seconds.
+
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Production-matching system deps. Versions resolved from
+# jammy / jammy-updates / jammy-security so the resulting cargo
+# build/test environment is identical to what `apt install` would
+# yield on a clean JetPack 6 Jetson.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential \
+        cmake \
+        pkg-config \
+        ca-certificates \
+        curl \
+        git \
+        libssl-dev \
+        libclang-dev \
+        clang \
+        libopencv-dev \
+        libavcodec-dev \
+        libavdevice-dev \
+        libavfilter-dev \
+        libavformat-dev \
+        libavutil-dev \
+        libswscale-dev \
+        libswresample-dev \
+        protobuf-compiler \
+    && rm -rf /var/lib/apt/lists/*
+
+# `clang-sys` (used by both opencv-sys and ffmpeg-sys-next via bindgen)
+# looks for `libclang.so` in the default linker search path. Ubuntu's
+# `libclang-14-dev` only ships the unversioned symlink under
+# `/usr/lib/llvm-14/lib/`, so we point at it explicitly. Without
+# this, the build panics with "a `libclang` shared library is not
+# loaded on this thread".
+ENV LIBCLANG_PATH=/usr/lib/llvm-14/lib
+
+# Pin to the same Rust toolchain the workspace's rust-toolchain.toml
+# expects (channel = "stable", profile = "minimal", components =
+# ["rustfmt", "clippy"]). We pin the patch level here to keep CI
+# reproducible; the toolchain file overrides via `+stable` if the
+# Jetson dev wants a moving target.
+ENV RUSTUP_HOME=/usr/local/rustup \
+    CARGO_HOME=/usr/local/cargo \
+    PATH=/usr/local/cargo/bin:$PATH
+
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+        | sh -s -- -y --default-toolchain 1.82.0 --profile minimal \
+            --component rustfmt --component clippy \
+    && rustup --version \
+    && cargo --version \
+    && rustc --version
+
+WORKDIR /workspace
+
+# Default to running the full workspace test suite. Override at
+# `docker run` time when needed.
+CMD ["cargo", "test", "--workspace", "--no-fail-fast", "--color", "always"]