Serialize FairPlay context creation

[LYJW131]

What changed

Serialize FairPlay persistent-key and decrypt-context creation with a dedicated mutex while keeping sample decryption fully concurrent after each worker has acquired its context.

The PR also fixes the existing Actions NDK extraction path so the repository's CMake configuration can find the downloaded toolchain during pull-request builds.

Root cause

Concurrent calls into getPersistentKey/decryptContext are not reliable. Under bursts of fresh streams the wrapper throws:

Fairplay error. KDProcessPersistentKeyWithAT status: -42812

The failure closes one TCP connection, and wrapper-manager versions that treat a connection error as instance failure can then restart the whole wrapper. Limiting sample decryption would hide the symptom and reduce steady-state throughput, so this change protects only the short context-construction section.

Impact

• prevents concurrent entry into the unsafe FairPlay context-construction path
• preserves parallel sample decryption across established contexts
• protects the shared preshare context with the same mutex
• no wire-protocol or CLI changes

Validation

• cross-compiled successfully with Android NDK r23b and the repository CMake build
• GitHub Actions build job passes with the corrected NDK path
• baseline: ten fresh concurrent streams failed on the second round with -42812
• candidate: five consecutive ten-stream rounds completed without a FairPlay error
• each round decrypted about 1.42 GiB / 94,660 samples
• candidate aggregate throughput remained about 103-109 MiB/s
• the original z16 wrapper binary and containers were restored after testing