fix(studio): surface a render panic instead of caching an empty frame

[LeadcodeDev]

Severity Low, category correctness. Location: crates/rustmotion-studio/src/editor/frames.rs:42

Impact

render_frame panics on failure (.expect("render frame"), .expect("rgba matches dimensions"), .expect("encode jpeg")). Because the panic happens in the scoped child thread and is consumed by join().unwrap_or_default(), the catch_unwind wrapper in view.rs::serve_or_render never fires — so fail_ledger().record_failure(key) is unreachable on that path and the whole retry-budget mechanism is dead code for the on-demand asset handler. Instead the empty Vec is treated as a successful render: frame_cache().insert(key, rendered.clone(), ...) caches zero bytes, and the responder replies 200 image/jpeg with an empty body. The canvas shows a permanently broken image for that (generation, frame, scale) and the cache guarantees it is never re-attempted. (The prefetch worker path calls render_frame directly and is correctly fenced.)

Fix

Return Result from render_frame_deep (propagate join()'s Err instead of unwrap_or_default), or at minimum refuse to cache/serve an empty byte vector and record it in the fail ledger so serve_or_render returns 500 and the webview keeps the previous frame.

Evidence the audit read

std::thread::scope(|scope| {
    std::thread::Builder::new()
        .stack_size(RENDER_STACK)
        .spawn_scoped(scope, || render_frame(scenario, tasks, frame, scale))
        .expect("spawn render thread")
        .join()
        .unwrap_or_default()
})

Stacked on fix/studio-stale-write, which carries the previous finding of this workstream. GitHub shows only this finding's diff; merge in order.

Part of the September 2026 audit remediation chantier. Refs #220 (RM-28).