[tetrisgm]

HD FMV replacement in #718 could select the wrong replacement after a seek or state load, and advanced subframes from host time even while the guest was paused. This continuation keeps the original contributor's HD movie feature while binding lookup and subframe timing to guest events.

The renderer now receives an immutable guest timeline snapshot. FMVHD003 packs identify a movie by its SetLoc range and each source frame by the delivered CD sector interval, with the native frame signature as a second check. Duplicate-looking frames are distinct. Guest cycles drive subframe phase; MDEC decode events, seeks, state loads, rollback, and movie exit reset it. An unmatched or failed lookup displays the native PS1 frame. Signature-only FMVHD002 packs require explicit PSX_FMV_HD_LEGACY=1 because they cannot resolve seek and repeated-frame ambiguity.

This supersedes the unresolved timeline design in #718. The original HD replacement implementation is by @yacineolivier-maker; this branch includes that work and the reviewer-requested safety changes. Please review this PR alongside #718. It does not modify or close the contributor's branch.

Verification:

• Windows and macOS: full psx-runtime builds and focused gpu_fmv_hd_test passed. The synthetic test covers malformed packs, worker/decode lifecycle, pause, guest-cycle subframe advancement, duplicate frames, seek generation, movie exit, and load/rollback epochs.
• R4 local-disc replay with an 80-frame local synthetic FMVHD003 pack: expected HD replacements at SetLoc 192822 and delivered LBAs 194127–194324, zero dispatch misses. First replacement at guest frame 1475/cycle 832608000, delivered LBA 194129, MDEC ordinal 260.
• Host pause for 0.5 s held guest cycle, HD count, and audio counters. Save/load advanced execution epoch 1→2 and playback resumed.
• Across one unpaused movie interval, guest time advanced 366.67 ms, SPU output advanced 16,170 samples/366.67 ms, CD input 16,464 samples/373.33 ms, and host output 15,876 samples/360.00 ms (44.1 kHz). This measures cadence within 6.67 ms, not sound-to-image content alignment.
• TCP Start skipped the movie. At guest frame 1494, HD source tracking reset to -1; HD frame count/lookups stopped at 17/530 through frame 1514. CD input stopped while queued host audio drained. Zero dispatch misses.

R4's intro has no movie seek control. Local Rewind was off in this test configuration and netplay rollback inactive; the focused test exercises seek generation and rollback epoch changes. The replacement images are conspicuous synthetic frames, so content-level A/V lip-sync is not measured. No retail movie assets or synthetic pack are included.