Video offload: Mesa etnaviv in the image, forgectrl pinned, the H.264 stream in the catalog

The stream conversion now runs on the GC880 when the image carries the
GL stack, and /cam/h264 serves the same picture as fragmented MP4 in a
fraction of MJPEG's bytes (forgectrl 6573abd). This side supplies what
that needs and holds it to account:

- Distro: opengl stays a feature, with mesa trimmed to exactly the
  path used (gallium etnaviv, GLES/EGL/GBM, no GLX, no display
  platforms). Image: libegl-mesa, libgles2-mesa, libgbm,
  mesa-megadriver. forgectrl dlopens them, so an image without them
  still streams on NEON. Platform change: the next campaign is full.
- forgetest: camera.h264-stream exercises the endpoint end to end
  (codec header, init segment, media fragments, /cam/status encoder
  state) and accepts a clean 503 on a machine without the stack;
  the camera covers name the new forgectrl files.
- VIDEO.md 5.6 now describes both streams and why H.264 earns its
  place (the WiFi transmit path measures about 7 percent of the core
  per MB/s sent); BRINGUP records the bench-validation checklist as
  Next work item 20, including the release-size watch: mesa must fit
  the 200 MiB slot gate.

meta-forgefirm/conf/distro/forgefirm.conf

@@ -5,9 +5,17 @@ DISTRO_NAME = "OpenGlow/ForgeFIRM"
 DISTRO_VERSION = "0.0.0"
 
 DISTRO_FEATURES:remove = " \
-  3g alsa avahi bluetooth bluez5 ext2 ipv6 irda nfc nfs opengl pci pcmcia \
+  3g alsa avahi bluetooth bluez5 ext2 ipv6 irda nfc nfs pci pcmcia \
   pulseaudio vulkan wayland x11 zeroconf "
 
+# opengl stays: forgectrl's camera demosaic runs as GLES2 fragment
+# shaders on the GC880 (etnaviv), reached through surfaceless EGL with
+# no display stack. Mesa is trimmed to exactly that: the etnaviv
+# gallium driver, GLES/EGL/GBM, no GLX, no X11/Wayland platforms
+# (both remain removed above), so the cost is the libraries and the one
+# driver, not a graphics stack.
+PACKAGECONFIG:pn-mesa = "opengl gles egl gbm gallium etnaviv"
+
 # System logger: rsyslog replaces busybox syslogd/klogd. Every ForgeFIRM
 # process logs through it and it is the only log writer (one directory
 # per logger under /data/log/forgefirm; per-logger levels and the remote