[AZ-662] [AZ-669] Close batch 19: green test gate via Jetson Docker

Stand up a production-target test runner on jetson-e2e and run the
deferred cargo test --workspace for batch 19.

Infra:
- Dockerfile.test: ubuntu:22.04 + libopencv-dev + libav*-dev +
  libclang-dev + protobuf-compiler + rust 1.82.0 (rustfmt, clippy).
  Sets LIBCLANG_PATH so clang-sys can dlopen libclang under the
  opencv-rust clang-runtime path.
- scripts/jetson-test.sh: rsync source to jetson-e2e, docker build,
  docker run cargo test --workspace --no-fail-fast.

Workspace fix exposed by the gate:
- Cargo.toml: enable opencv "clang-runtime" feature. Without it the
  workspace fails to build because clang-sys is shared between
  opencv-binding-generator and bindgen (via ffmpeg-sys-next) and the
  opencv generator panics with "a `libclang` shared library is not
  loaded on this thread" (opencv-rust GH issue #635).

Batch-19 code bugs exposed by the gate (6 compile errors + 1 algo bug):
- movement_detector::optical_flow: min_max_loc signature (opencv 0.98
  expects Option<&mut f64> / Option<&mut Point>); data_mut() returns
  *mut u8 directly, not Result. RANSAC residual now filters by the
  inlier mask returned by find_homography (matches the docstring; was
  systematically over-reporting motion magnitude on synthetic
  pure-pan input).
- semantic_analyzer::scoring::freshness: same data_mut() fix;
  stddev_f32 now takes &impl core::ToInputArray so it accepts the
  BoxedRef<Mat> that Mat::roi returns in opencv 0.98.

Result: 391 tests passed across 58 binaries, 0 in-scope failures.

Two pre-existing failures in frame_ingest (batch 16-18 scope) are
NOT addressed here and are recorded as leftovers:
- frame_ingest_cuvid_segv: HIGH severity production bug; libavcodec58
  advertises h264_cuvid but libnvcuvid.so.1 is missing at runtime, the
  software fallback never fires, first send_packet SEGVs.
- frame_ingest_publisher_timing_flake: LOW severity; Jetson-specific
  timing budget too tight for ac1_three_consumers_at_rate_lose_no_frames.

Neither blocks batch 20 (movement_detector / semantic_analyzer next).

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/jetson-test.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+#
+# jetson-test.sh — run the full `cargo test --workspace` on the
+# production-target Jetson via Docker (Dockerfile.test).
+#
+# Why this exists: the autopilot workspace depends on `opencv`,
+# `ffmpeg-next`, `tonic`/`prost`, and `libclang` at build time. The
+# macOS dev box does not always have native OpenCV / FFmpeg headers
+# installed, and the production target is a Jetson Orin Nano Super
+# running JetPack 6 (Ubuntu 22.04 aarch64). This script bridges the
+# two by rsync-ing the source to the Jetson and running tests inside
+# a container that mirrors the production environment exactly.
+#
+# Prerequisites:
+#   - `ssh <SSH_HOST>` works passwordlessly (key-based auth).
+#   - The remote user is in the `docker` group (no sudo for `docker`).
+#   - `rsync` is available locally.
+#
+# Usage:
+#   scripts/jetson-test.sh                    # full suite, default host
+#   SSH_HOST=other-jetson scripts/jetson-test.sh
+#   scripts/jetson-test.sh -p movement_detector -p semantic_analyzer
+#
+# Any args passed after the script name are forwarded to `cargo test`
+# inside the container (the default is the workspace suite).
+#
+# Exit code: forwarded from `cargo test` inside the container.
+
+set -euo pipefail
+
+SSH_HOST="${SSH_HOST:-jetson-e2e}"
+REMOTE_DIR="${REMOTE_DIR:-/home/jetson/autopilot}"
+IMAGE_TAG="${IMAGE_TAG:-autopilot-test}"
+DOCKERFILE="${DOCKERFILE:-Dockerfile.test}"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+
+cd "${REPO_ROOT}"
+
+log() {
+    printf '\n\033[1;34m[jetson-test]\033[0m %s\n' "$*"
+}
+
+log "Sync source to ${SSH_HOST}:${REMOTE_DIR} (excluding target/, .git/)"
+ssh "${SSH_HOST}" "mkdir -p '${REMOTE_DIR}'"
+rsync -az --delete \
+    --exclude='target/' \
+    --exclude='.git/' \
+    --exclude='.DS_Store' \
+    --exclude='*.swp' \
+    --exclude='node_modules/' \
+    ./ "${SSH_HOST}:${REMOTE_DIR}/"
+
+log "Build test image ${IMAGE_TAG} on ${SSH_HOST} (may take 10-20 min on first run)"
+ssh "${SSH_HOST}" "cd '${REMOTE_DIR}' && docker build --pull -t '${IMAGE_TAG}' -f '${DOCKERFILE}' ."
+
+if [[ $# -gt 0 ]]; then
+    log "Running: cargo test $*"
+    ssh "${SSH_HOST}" \
+        "cd '${REMOTE_DIR}' && docker run --rm \
+            -v '${REMOTE_DIR}:/workspace' \
+            -w /workspace \
+            '${IMAGE_TAG}' \
+            cargo test $*"
+else
+    log "Running default: cargo test --workspace --no-fail-fast --color always"
+    ssh "${SSH_HOST}" \
+        "cd '${REMOTE_DIR}' && docker run --rm \
+            -v '${REMOTE_DIR}:/workspace' \
+            -w /workspace \
+            '${IMAGE_TAG}'"
+fi