Prevent stale FFmpeg loads from publishing after close or replacement

[Blackspirits]

Summary

FfmpegPlayer.LoadFile creates its native Session inside Task.Run. VideoPlayerControl.Open awaits that task, and the control explicitly allows teardown/layout rebuild/fullscreen transitions to happen while the await is in progress.

Previously CloseFile could only dispose the already-published _session. A slow Session still being constructed was invisible to it. That creates two races:

• close/dispose during a slow open: the old task can finish later and publish a live session after the file was already closed;
• overlapping opens: an older task can finish after a newer one and overwrite _session, resurrecting the wrong media file.

This change:

• serializes publication/replacement with a small load-state lock;
• assigns a monotonically increasing load generation to each open/close;
• prevents a completed task from publishing unless its generation is still current;
• disposes stale sessions before they can start;
• preserves current-frame cleanup and existing paused-first-frame behavior;
• ensures an old failed load cannot clear the file name of a newer load.

Validation

• based on upstream f67b07f5b143fa47c87255ca1c3ed7adb3bd7142
• VideoPlayerControl.Open explicitly documents that teardown can happen while LoadFile is awaited
• the previous FfmpegPlayer.CloseFile had no token/generation/cancellation state for a Session still being constructed
• concurrent close/replacement is now resolved under the same publication lock
• no public interface change
• full solution CI pending

AI assistance: ChatGPT was used to audit asynchronous FFmpeg session ownership across open, close, dispose and overlapping-load paths.

[Blackspirits]

Superseded by current-base draft PR #95. Upstream changed FfmpegPlayer materially after this draft, and the first generation-based fix was itself strengthened during adversarial review to prevent stale cleanup from erasing a newer Session's frame. #95 carries the corrected current-base version and has full green CI. Closing this older draft; no merge performed.