feat(abi): set_dataset_metadata runtime-host tail slot (0.32.0)

[facontidavide]

First of the three dataset-metadata PRs (SDK → PJ4 → plugins): a generic channel for a loader to attach descriptive metadata to the dataset it produces, so the host can show provenance for any loaded artifact (the motivating case: an MCAP restored from the source cache showing its embedded pj.capture/pj.recording facts on plain File → Open).

New tail slot on PJ_data_source_runtime_host_vtable_t, appended after complete_ingest (offset 120, vtable 120 → 128):

bool (*set_dataset_metadata)(void* ctx, PJ_string_view_t metadata_json, PJ_error_t* out_error);

Contract highlights:

• One UTF-8 JSON object of observations ABOUT the loaded artifact — deliberately disjoint from attach_source_record (request identity): it never affects caching, restore routing, or trust.
• Host copies during the call; each successful call replaces the whole document; "{}" clears it; callable at any point while the ingest context is live.
• Bounds (bytes/depth/nodes) are host policy; a rejection returns false + error with no effect on sample ingestion, completion, or cache eligibility.
• Old hosts negotiate via struct_size (PJ_HAS_TAIL_SLOT); plugins degrade to "no metadata".

C++ surface: DataSourceRuntimeHostView::setDatasetMetadata + DatasetIngestHostView forwarding, mirroring the attachSourceRecord/completeIngest wrapper pattern. No get counterpart by design — the only reader is the host GUI (own store), and the writer owns the whole document; a getter is one more compatible tail slot if a real cross-plugin consumer ever appears.

Tests: pinned ABI layout sentinels; new dataset_metadata_test.cpp (flow-through + replace semantics, missing-slot and short-struct_size negotiation — a stale non-null pointer past the reported size is never read —, host-rejection reason surfacing, unbound view, ingest-view forwarding). The three test vtables using designated initializers gained the explicit member (-Werror=missing-field-initializers).

Docs: data-source-guide host-view table row; CHANGELOG 0.32.0 — unreleased entry.

Validation: full build + 96/96 tests, ./test_sdk_install.sh PASSED (incl. the fmt-symbol guard).

Merge order: this PR first, then release 0.32.0; the PJ4 and plugins PRs carry TODO(sdk-0.32) seams that get wired once the release exists.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TTJvEsHX26rG4cHmqppvQg