Resync the source sink after an ASRC failure, and keep elapsed_ps from overflowing #24

Problem

When the sink's ASRC fails while its correction is engaged, the raw chunk is written and written_ advances but the ASRC's position does not, so the next chunk is silently dropped. Separately, Segment::elapsed_ps is an int64 count of picoseconds that overflows after about 106.7 days of one anchor. Both are unlikely in practice.

Evidence

Checked against the code at e69f3b46a801:

• (b) The branch is as described. src/source_sink.cpp:162-165 writes the raw chunk and does written_ += frames when !engaged || !processed. On a failure asrc_->produced() does not advance (source_clock.cpp:229 only runs on success). The next successful call has end = first + written, and the guard end > written_ at line 171 then skips or truncates that chunk.
• (c) The arithmetic is right. Picoseconds in int64 overflow at 9.22e18 / 1e12 s, about 106.7 days. add_segment at src/sched/timeline.cpp:50-57 accumulates last.elapsed_ps with no guard, and the signed overflow is undefined behavior. The anchor is only rebuilt by build_anchor at start or seek (host_view.cpp:873-886), and add_segment is also called on a live format change at host_view.cpp:399, so a live input playing one anchor for over 106 days and then changing format hits it.

Checked and not part of this issue

• (b) The 'silently dropped' framing is overstated. process() can only return nullopt when micro-resampler refuses, and the only refusals are initialize() and copy_input_to_history(). The history buffer is presized for max_block (source_clock.h:124-126), so it never reallocates. A call that takes nothing is not reachable with frames > 0 and capacity = max_output(frames). frames == 0 on an unprimed ASRC can't coincide with engaged() because restart_correction() resets both. After the single failure the ASRC lags written_ by one chunk, the next chunk is mostly or entirely skipped, and the third chunk resumes (end = first + F > written_). The result is a one-chunk glitch that self-heals, not a persistent loss.
• (c) 'then segment_output_index makes cut_to exceed MAX_BOUNDARY_EXTENSION' is plausible but not shown. segment_output_index reads elapsed_ps directly (timeline.cpp:135-140). A wrapped negative elapsed_ps would give a wrong boundary index, and cut_to returning false (group_audio.cpp:898) is one possible symptom.

Direction

Resync written_ to the ASRC position or restart the correction on failure; store whole seconds plus a remainder, or rebase on pruning.

Done when

• A test covers the ASRC-failure resync; the overflow fix is shown by a table row near the limit.