Put a frame into a broadcast and take the same frame out

frq.moq.media is origins, broadcasts and tracks, and frq.moq.uniffi grows the
other half of the buffer codec: UniFFI serialises records, enums and optionals
into a RustBuffer big-endian, and until now this side could only read one.

An origin producer is a plain constructor rather than something a session
hands out, which is what makes any of this testable without a relay: create an
origin, create a broadcast under it, publish a track, and `consume` gives you
the subscriber's side of the same broadcast. No QUIC, no second process, and
the shapes over a session are identical -- only where the origin comes from
changes.

Two tracks in the smoke test, because they prove different things.
subscribe_media is the one frq.av will use and is checked as far as it can be
here: a media track declares a codec, and avc3 means the container really does
try to read Annex B out of whatever arrives, so a frame carrying the word
hello is never coming back out of it. The opaque track beside it parses
nothing, which is what lets the payload round trip be an assertion.

Four found by running it, none of them visible in a signature:

A top-level String argument is BARE UTF-8 -- the RustBuffer's own len
delimits it -- while a string inside a record, enum or optional carries an i32
byte count, because there the buffer's length no longer says where it ends.
Both are String on the Rust side. Backwards is not an ABI fault: the four
prefix bytes join the track name, and the object answers `not found` for a
track that is plainly there.

Each argument is lowered into a buffer of its OWN. The concatenation a
record's fields go through stops at the record boundary, so subscribe_media
takes three buffers and not one.

write_frame takes MoqFrame, not MoqMediaFrame -- one word and one field apart,
and the producer's has no keyframe flag because the container works that out
from the bitstream. The extra byte is not rejected; it is lifted, found left
over, and panicked on.

And complete! handed back a pointer into an arena it had already closed. That
one has been there since the futures were written and never fired, because a
:u64 future does not take that path. An :rb future now requires a lift
function and calls it while the cell is still alive.

Still outstanding: a payload comes back as a jolt string, which survives only
while it is text. frq.av's rule is that a video frame goes from the decoder's
buffer to the texture as a pointer and never becomes a jolt value at all, and
honouring that is the next thing this namespace owes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>