feat(sdk): dataset-qualified names + pj.playback/viewport/plot_tabs host services (0.28.0)

[Alvvalencia]

Everything the Assistant Agent toolbox needs from the SDK, in one MINOR: the dataset-qualified naming contract its reads and creates rely on (previously #183), and the host services that let a plugin drive the transport and compose views of its own. Additions only — no existing struct, vtable slot or wire format changes, so every already-built plugin keeps working without a recompile (abidiff: additions only).

Dataset-qualified series names — contract and shared helper

pj.data_processors.v1 addressed input series by bare topic/field names and never said what a name means when several loaded datasets share topic names, so conforming hosts filled the gap incompatibly (PJ4's transform path refused duplicates while its marker path silently bound the first-loaded dataset; fixed by PlotJuggler/PJ4#619). The contract is now explicit in the PJ_data_processors_host_vtable_t doc block (DATASET-QUALIFIED NAMES):

• A series' full identity is (dataset, topic, field); a bare name is an abbreviation. An input MAY carry the qualifier dataset_source:topic/field — the same form hosts print as a series identity, so displayed names round-trip as inputs.
• The qualifier is matched against the loaded source names (longest match wins), never split blindly at :, so stream-style names like [stream] UDP Server need no escaping.
• An unknown qualifier is an error (no fallback to the bare reading); a bare name that exists in several datasets MUST be refused with the qualified candidates, never resolved by load order; qualified inputs of one processor must agree on a single dataset. Marker per-series output keys accept the qualifier the same way.

New installed header pj_base/sdk/dataset_qualified_name.hpp (splitDatasetQualifier / qualifiedSeriesName, header-only, std-only) is the shared parser/composer, replacing the two copies that exist today in PJ4 and in a plugin. Tests: pj_base/tests/dataset_qualified_name_test.cpp.

Host services pj.playback.v1, pj.viewport.v1, pj.plot_tabs.v1

• pj.playback.v1 (PJ_playback_host_vtable_t, sdk::PlaybackHostView / PlaybackHostService): play / pause / seek / set_playback_rate / get_state (ABI-frozen PJ_playback_state_t snapshot) / to_display_time (absolute ns → display-axis seconds via the owning dataset's offset). Every time in the service is display-axis seconds, the numbers the plot X axes and the playback slider show. Global by nature: one time cursor is shared by every plot.
• pj.viewport.v1 (PJ_viewport_host_vtable_t, sdk::ViewportHostView / ViewportHostService): zoom_to_time_range (X window in display-axis seconds; per-plot Y preserved; XY/empty plots untouched) and zoom_reset (fit). Both are scoped to the tabs the calling plugin owns; a plugin owning none has nothing to zoom, which is an error rather than a silent no-op.
• pj.plot_tabs.v1 (PJ_plot_tab_host_vtable_t, sdk::PlotTabHostView / PlotTabHostService): a plugin composes plotting tabs of its own — create_tab / close_tab / list_tab_ids / tab_config / add_curve / remove_curve / clear_tab. Ids are plugin-chosen and namespaced per plugin (the pj.data_processors.v1 discipline) and every slot is scoped to the caller's own tabs, so the user's tabs are neither disclosed nor mutable through it. Curves are addressed by their parts (topic, field, dataset source) rather than a joined path, because field paths contain / and dataset names contain :. tab_config reads back what a tab actually holds, so a caller can report what was drawn instead of what it asked for.
• Codec fix: deserializePlotMarkers decodes an empty buffer as an empty set (the "clear my markers" tombstone a producer publishes on a replace-only store) instead of erroring; null-with-size, truncated and malformed payloads still error.
• Error-code convention: PJ_ERROR_CODE_REJECTED / PJ_ERROR_CODE_INTERNAL named in the ABI header — aggregators (a kind router probing several backends) rely on the distinction, which was previously folklore.
• Dialog-property docs for pj_enable_when and the new pj_visible_when (host behaviour: conditional visibility and ;-joined clauses, documented here for plugin authors); playback_viewport_api_test and plot_tabs_api_test covering the ABI structs, view wrappers and traits.

Versioning

VERSION remains 0.28.0. These additions share the unreleased, untagged 0.28.0 release with source-record attachment (#189). The branch is rebased onto main, including #189 and #190; the existing release history is preserved and all of this PR's entries are under 0.28.0.

Verification

• Rebased SDK: ./build.sh --debug && ./test.sh, 88/88 tests passed with ASAN, including a regression test for a growing tab list between count and fill. The wrapper returns a retryable error instead of reading beyond its buffer.
• Contract, host side: PJ4 fix/dataset-qualified-inputs (#619) rewired locally to delegate to the new header — all of its dataset-qualification tests pass unchanged, and a GUI end-to-end with two datasets sharing an identical topic layout (a plugin creating markers on run_b.mcap:/sensor/temperature/data) landed on the correct dataset, region count and covered time matching an independent decode of the file (7 regions, ~12.9 s; the first-loaded dataset would have given ~7.7 s).
• Services, host side: the consumer tools were E2E-verified in the application (play/pause/seek/rate clamped and reported, zoom/framing pixel-verified, model-owned tabs created, zoomed and closed with the user's tabs untouched). The host-side PJ4 wiring is in #573.

Follow-ups (separate changes, once 0.28.0 is picked up)

• PJ4 drops its private copy of the splitter and includes the header.
• Plugin-side callers do the same and start emitting the qualified form on creates.
• Addressing two datasets that share one source name stays out of contract (ambiguous → error); a typed dataset id would be a tail-appended ABI addition if ever needed.