Reject FFmpeg frames from cancelled sessions

[Blackspirits]

Summary

#100 allows Session teardown to return after a bounded wait and defer final cleanup until a stubborn worker actually exits. That removes the resource use-after-free window, but it exposes a UI-lifetime race that the old blocking teardown normally hid.

A present worker from the cancelled Session can finish an iteration after close/replacement and call FfmpegPlayer.Present, publishing an obsolete frame back into the owner after the new load has already taken over.

This change, layered on #100:

• passes the Session's shared load-cancellation identity into FfmpegPlayer.Present;
• serializes publication with the existing _loadLock;
• rejects and returns the frame when the player is disposed, the Session is cancelled, or the player's active cancellation identity no longer matches that Session;
• keeps lock ordering consistent with load/close cleanup: _loadLock → _currentFrameLock;
• leaves frame version/events unchanged for valid active-session presentations.

This means deferred workers may finish, but they cannot resurrect stale media in the UI.

Validation

• based on Defer FFmpeg resource cleanup when a worker misses the stop timeout #100 HEAD 7c93a495f0b757b5c8f1c1725eddccf71fab964a
• diff is limited to frame publication identity/guarding
• rejected frames are returned through their original VideoFrameQueue, which disposes them when the queue is already closed
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• UI suite: 5,151 passed, 9 skipped, 0 failed (5,160 total)
• retry step was not used
• validation run: #34780599136

AI assistance: ChatGPT was used to review cross-session frame ownership after deferred FFmpeg teardown.

[Blackspirits]

Independent adversarial re-check: deferred teardown means an old present worker can finish an iteration after close/replacement. The final guard serializes publication with _loadLock and rejects frames when the player is disposed, the Session cancellation is set, or the active cancellation identity no longer matches. Rejected frames are returned through the original VideoFrameQueue, which disposes them when closed. Lock order remains _loadLock -> _currentFrameLock, matching load/close cleanup, so no new inversion was introduced. Full CI #34780599136 passed restore, build and the complete suite on the first run; UITests reported 5,151 passed, 9 skipped, 0 failed. Retry was not used. No blocker identified. Keep draft; no merge performed.