feat(vt): own external graphics placement semantics

[gold-silver-copper]

Summary

• add a public terminal-owned external-placement API for embedders that render payloads outside rio-vt
• mutate and clip placements at the same scrollback, page-margin, resize/reflow, alternate-screen, erase, clear, reset, and ring-eviction boundaries as the grid
• align direct Kitty placements with Kitty-specific page-margin, erase, deletion, retransmission, placement-cap, and image/number/placement-ID lifetime rules
• expose configurable Kitty media/resource policy and make rejected queries/transmissions report failure
• harden decoded image bounds, chunk aborts, file/temp/shared-memory reads, endpoint arithmetic, and hostile row-span cursor movement

This is the rio-vt prerequisite for orhun/ratty#141. Ratty pins immutable revision 535495772f8548e2cbf9a840938c8eca21714888 and removes its duplicated scroll reconstruction and Kitty parser.

Verification

• cargo +1.96.1 fmt --all --check
• git diff --check
• cargo +1.96.1 test -p rio-vt --all-features — 518 passed
• cargo +1.96.1 test -p rio-backend --all-features — 225 passed
• cargo +1.96.1 test -p rio-vt --no-default-features --features graphics png_rgba_output_must_fit_the_total_store_before_pixel_decode --lib — 1 passed
• cargo +1.96.1 clippy --workspace --all-targets --all-features -- -D warnings
• cargo +1.96.1 doc -p rio-vt -p rio-backend --all-features --no-deps — passed with the existing rustdoc warning baseline

The complete six-file diff was independently reviewed for correctness, regressions, security, resource bounds, and protocol conformance. The PR remains draft while coordinated downstream CI and maintainer review complete.