fix(codec): fix decoder packet leak and extradata over-read

Allocate packet payloads with av_new_packet so they are freed through the
owning AVBufferRef instead of leaking on every decode. Pad extradata with
AV_INPUT_BUFFER_PADDING_SIZE for FFmpeg's bitstream parsers. Reject
oversized frames before the int cast, handle unexpected EOF in the
EAGAIN-retry loops, and add the missing <limits> include. Document the
valgrind codec check in docs/RUNBOOK.md.

Validated with valgrind: 0 bytes definitely lost, 0 invalid reads.

docs/RUNBOOK.md

@@ -0,0 +1,35 @@
+# Runbook — build and validation commands
+
+Reusable validation steps for this repository. Run the relevant ones before
+considering a change complete.
+
+## Build and test
+
+```sh
+meson setup build          # once
+meson compile -C build
+meson test -C build --print-errorlogs
+```
+
+## Memory and correctness checks (codec changes)
+
+Run the codec round-trip test under valgrind after touching the encoder or
+decoder:
+
+```sh
+valgrind --leak-check=full --errors-for-leak-kinds=definite \
+    build/tests/test_codec_roundtrip
+```
+
+Expected: no "definitely lost" bytes and no "Invalid read/write" errors.
+FFmpeg may keep some "still reachable" allocations at exit; that is normal.
+
+This check caught two real defects in the Phase 2 decoder: a per-packet
+payload leak and an unpadded extradata buffer over-read. Keep using it.
+
+## Formatting
+
+```sh
+find include src tests -type f \( -name '*.cpp' -o -name '*.h' \) \
+    -exec clang-format --dry-run --Werror {} +
+```