perf(render): take-4 slice 2 — IsOpaque memcpy, integer bilinear, pump scratch pool

Take 4: pacing held (sync perfect) but avg render stayed 58.9ms — 2M
managed row-walk iterations + a fresh 8.3MB buffer every tick (LOH churn
into GC stalls inside the render measurement).

- VideoFrame.IsOpaque: producer-contract flag (screen capture + webcam —
  DWM/MF fill alpha 255; media/chat/web/static NOT flagged). Full-cover
  aligned opaque backdrop = ONE Buffer.BlockCopy; black pre-fill skipped
  when it covers.
- General BlitContent: integer 8.8 fixed-point bilinear + blend, row
  invariants hoisted, no per-pixel division/Math.Round. Within ±1 of the
  float reference (pixel tests allow ±2). Research per derivative-work
  rule: libyuv row/scale kernels (chromium.googlesource.com/libyuv/libyuv).
- FramePump scratch pool (max 4, length-keyed, owned-by-reference):
  release strictly AFTER SubmitFrameAsync returns (stdin write copies);
  Contains-guard makes the transition Cut alias safe.
- Removed the dead per-tick fromScene render + fromSceneProvider seam —
  BlendFrame consumes TransitionService.FromFrame captured at Start; the
  pump's render fed nothing. MainViewModel call site updated (signature).

Bugs caught by the pixel probes pre-ship (recorded MyMistakes): first
Bilinear double-shifted both stages (solid-255 sampled to ~1 -> general
path drew nothing); sentinel 0xAB collided with an x+y pixel. FakeEncoder
snapshots submitted frames (mirrors real copy semantics under recycling).

ONE integration test: Pump_Pools_ScratchBuffers_Across_Frames_Without_
Stale_Pixels (alternating backdrops + repeated backing identity). Direct
pin: Composite_OpaqueFullCover_Backdrop_CopiesEveryPixel_Into_Scratch.
Clean build 0 warnings; 59/59 per-class + RealApp boot-smoke. take 5
verdict: expect avg render <= ~10ms, ~300/300 frames. Docs same commit:
ai.md pipeline section, TASKS.md TASK 18, HANDOFF rewritten (Unit B spec
+ settled decisions queued).

ai.md

@@ -707,9 +707,29 @@ seam:** `Func<Scene?>`, `Func<SceneElement, VideoFrame?>` resolver, `Func<Compos
   general per-pixel path stays for scaled/round/mirrored elements (webcam) — pixel-identical, and it is
   only ~130k px. Test: `Pump_Paces_To_The_Deadline_Compensating_Render_Cost` records the requested wait
   via the pacing seam (a seam fake must genuinely await — a synchronous completed task runs the whole
-  pump loop on `StartAsync`'s continuation and hangs the run; MyMistakes). **Next slice if take 4's
-  stats show it:** 8.3MB fresh `byte[]` per frame → LOH churn/GC stalls — pool the master buffer if avg
-  render lands ≤ budget but frames still hiccup.
+  pump loop on `StartAsync`'s continuation and hangs the run; MyMistakes).
+- **Slice 2 of the render fix (2026-09-04, take 4):** the pacing held (file no longer truncated at
+  loop level) but render stayed at 58.9ms — the per-pixel row walk was still 2M managed iterations and
+  every tick allocated a fresh 8.3MB master buffer. Three changes: (1) **`VideoFrame.IsOpaque`** — a
+  producer-contract flag (only the screen-capture and webcam paths set it; DWM/MediaCapture fill alpha
+  255 by contract); a full-canvas, aligned, opacity-1 blit of an opaque frame is now ONE
+  `Buffer.BlockCopy` (~1.5ms) instead of the loop, and the black pre-fill is skipped when the backdrop
+  covers. (2) **integer fixed-point bilinear** in the general `BlitContent` path (row-hoisted invariants,
+  no divisions, no `Math.Round`) — within ±1 of the float reference, inside the ±2 test tolerance.
+  (3) **scratch pool in the pump** — `AcquireScratch`/`ReleaseScratch` recycle the master buffer
+  (max 4, keyed by length, owned-by-reference so bake-cache/social-bar/static-art arrays can never be
+  captured); release happens strictly AFTER `SubmitFrameAsync` returns (the write to stdin copies),
+  and the free-list Contains guard makes the transition Cut path safe (`BlendFrame` returns the
+  to-frame itself, aliasing the scratch). The per-tick `fromScene` render in the transition branch was
+  **dead weight** (BlendFrame uses `TransitionService.FromFrame` captured at `Start`, never the pump's) —
+  removed, and the pump's `fromSceneProvider` seam + `MainViewModel` call site went with it. Tests:
+  `Pump_Pools_ScratchBuffers_Across_Frames_Without_Stale_Pixels` (the ONE: alternating backdrop colors
+  pin every frame's content, repeated backing-array identity proves the pool recycles),
+  `Composite_OpaqueFullCover_Backdrop_CopiesEveryPixel_Into_Scratch` (memcpy branch + scratch
+  sentinel). `FakeEncoder.SubmitFrameAsync` now snapshots bytes like the real stdin write — holding the
+  reference would race legitimate recycling. Take 5 must show `avg render ≤ ~10ms, ≈300/300`; the
+  vertical tier's final 1080×1920 `BilinearScale` still allocates fresh per frame (same GC lesson when
+  someone streams vertical — recorded as a follow-up, not silently "done").
 - **Stop ordering matters:** `StopAsync` stops the encoder (closes stdin → EOF → ffmpeg finalizes+exits)
   **before** awaiting the loop, because closing stdin unblocks a write stuck on pipe backpressure — the
   reverse order would deadlock. `ProcessFailed` self-stops the pump. `Failed` while live flips