feat(keyer): lightweight GStreamer graphics keyer (half CPU, full 30fps, no CEF)

[guycochran]

The keyer, finally cheap. The cbcrc html5-keyer composites graphics via headless Chromium (CEF). Without GPU-accelerated CEF it software-renders (SwiftShader): ~225% CPU / ~13-17fps for a simple lower-third.

Tried the obvious fix first — a GTX 970 was installed and passed through (nvidia-container-toolkit set up, GPU visible in containers ✅). But the CEF image hardcodes --use-gl=angle --use-angle=swiftshader-webgl in its compiled libgstcef.so — no env override — so the GPU stayed at 0% util, CPU still 225%. Confirmed dead end without rebuilding their image.

This PR replaces the keyer for the common case (PNG / logo / lower-third) with a plain GStreamer pipeline — no browser, no GPU needed:

mxlsrc(program) → videoconvert → gdkpixbufoverlay(PNG+alpha) → videoconvert → mxlsink

Drop-in on the keyer I/O contract (reads the program flow, writes the keyed flow).

HW-measured on the $400 box:

• Full 30fps (103 grains/3s) vs CEF's ~13fps
• ~1 core (105% CPU) vs CEF's 2+ cores
• Real composited video verified (frame dump: live program + overlay)

For animated/HTML graphics the CEF keyer stays the tool; this is the cheap 90% case (logos, bugs, static/semi-static lower-thirds). +5 tests.

Next step (not in this PR): wire it into the control plane (mxl-routes) + a service so it replaces the bypassed CEF keyer on the live box, with a real lower-third PNG.

🤖 Generated with Claude Code

[guycochran]

Wired into a service with a real lower-third — ON AIR ✅

Deployed on the box and HW-verified end-to-end: the lower-third 'MXL SWITCHER / Live on one $400 box' (cairo-rendered, cyan stripe, alpha) is composited over live program and flowing through WebRTC to viewers at 30fps / ~1 core.

Added:

• tools/make-lower-third.py — pycairo PNG generator (title/subtitle/colors = the Skin layer, no PIL/browser).
• Box service wiring: mxl-gst-keyer.service runs the gst-keyer (selector → gdkpixbufoverlay(PNG) → keyer-out 86efffa4); its ExecStartPost points the encoder at the keyed output. Ordered After=mxl-pgm-heal and it owns the encoder wiring (last-writer-wins → converges to KEYED).

Durability verified: survives gst-keyer service restarts and pgm-heal runs (ExecStartPost re-wires the encoder to keyed). The gst-keyer owns its wiring rather than pgm-heal orchestrating it (avoids the restart-ripple fragility).

For animated/HTML graphics the CEF keyer stays the tool; this covers the common static/semi-static lower-third + logo case at a fraction of the CPU.