chore: import upstream snapshot with attribution

.github/actions/install-ffmpeg-windows/action.yml

@@ -0,0 +1,60 @@
+name: Install FFmpeg (Windows)
+description: >-
+  Download a pinned FFmpeg GPL build for Windows from BtbN/FFmpeg-Builds and put
+  ffmpeg.exe / ffprobe.exe on PATH. We bypass `choco install ffmpeg` because
+  the Chocolatey community feed regularly returns 503 / 504 / NuGet resolver
+  errors with no retry, which makes it unsuitable as a CI dependency. From the
+  consumer's perspective this is equivalent — `where ffmpeg` (the PR #336
+  validation) and `findFFmpeg()` both pass.
+
+inputs:
+  release-url:
+    description: >-
+      URL of a BtbN/FFmpeg-Builds zip to install. Pinned to a specific
+      autobuild tag so a new upstream nightly can't silently change encoder
+      behavior under us. The asset filename embeds the git hash, so both
+      the tag and the filename must be bumped together when upgrading.
+    required: false
+    default: https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-04-30-13-44/ffmpeg-N-124278-gcc3ca17127-win64-gpl.zip
+  max-attempts:
+    description: Max download attempts before failing.
+    required: false
+    default: "8"
+
+runs:
+  using: composite
+  steps:
+    - name: Install FFmpeg from BtbN/FFmpeg-Builds
+      shell: pwsh
+      run: |
+        $ErrorActionPreference = 'Stop'
+
+        $url = '${{ inputs.release-url }}'
+        $maxAttempts = [int]'${{ inputs.max-attempts }}'
+
+        $zip = Join-Path $env:RUNNER_TEMP 'ffmpeg.zip'
+        $dir = Join-Path $env:RUNNER_TEMP 'ffmpeg'
+        New-Item -ItemType Directory -Force -Path $dir | Out-Null
+
+        for ($attempt = 1; $attempt -le $maxAttempts; $attempt++) {
+          Write-Host "--- Downloading ffmpeg from BtbN/FFmpeg-Builds (attempt $attempt/$maxAttempts) ---"
+          try {
+            Invoke-WebRequest -Uri $url -OutFile $zip -UseBasicParsing
+            break
+          } catch {
+            Write-Warning "Download failed: $($_.Exception.Message)"
+            if ($attempt -eq $maxAttempts) { throw }
+            Start-Sleep -Seconds (30 * $attempt)
+          }
+        }
+
+        Write-Host "--- Extracting ffmpeg ---"
+        Expand-Archive -Path $zip -DestinationPath $dir -Force
+
+        $bin = Get-ChildItem -Path $dir -Recurse -Filter 'ffmpeg.exe' | Select-Object -First 1
+        if (-not $bin) { throw "ffmpeg.exe not found after extracting $url" }
+
+        Add-Content -Path $env:GITHUB_PATH -Value $bin.Directory.FullName
+
+        Write-Host "--- ffmpeg sanity check ---"
+        & $bin.FullName -version | Select-Object -First 1

.github/actions/preflight/action.yml

@@ -0,0 +1,31 @@
+name: Preflight
+description: |
+  Cheap lint + format gate that runs before expensive CI jobs (regression
+  shards, perf shards, parity renders, Windows renders, catalog previews).
+  Single source of truth for the gate's bun/node/cache/lint/format steps —
+  tweak here and every preflight job picks it up.
+
+runs:
+  using: composite
+  steps:
+    - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      with:
+        node-version: 22
+
+    - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      with:
+        path: ~/.bun/install/cache
+        key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+        restore-keys: |
+          bun-${{ runner.os }}-
+
+    - shell: bash
+      run: bun install --frozen-lockfile
+
+    - shell: bash
+      run: bun run lint
+
+    - shell: bash
+      run: bun run format:check

.github/actions/prepare-ffmpeg-bin/action.yml

@@ -0,0 +1,28 @@
+name: Prepare FFMPEG_BIN for bun install
+description: >-
+  Copies the system ffmpeg binary to a writable temp location and sets
+  FFMPEG_BIN in the environment. ffmpeg-static's postinstall script checks
+  whether a file already exists at FFMPEG_BIN; if it does and process.exit(0)
+  is respected by the runtime, the CDN download is skipped entirely. If the
+  runtime intercepts process.exit(0) and the download proceeds anyway, using
+  a writable target prevents the EACCES failure that occurs when the
+  destination is a system path like /usr/bin/ffmpeg.
+
+runs:
+  using: composite
+  steps:
+    - name: Copy ffmpeg to writable path
+      shell: bash
+      run: |
+        FFMPEG=$(which ffmpeg 2>/dev/null || echo "")
+        if [ -n "$FFMPEG" ]; then
+          cp "$FFMPEG" "$RUNNER_TEMP/hf-ffmpeg"
+        else
+          # ffmpeg not pre-installed; write a stub so ffmpeg-static's postinstall
+          # finds a file at FFMPEG_BIN and exits early (statSync check) without
+          # attempting the CDN download. Jobs that need a real ffmpeg binary
+          # install it via apt before calling this action.
+          printf '#!/bin/sh\nexec ffmpeg "$@"\n' > "$RUNNER_TEMP/hf-ffmpeg"
+        fi
+        chmod +x "$RUNNER_TEMP/hf-ffmpeg"
+        echo "FFMPEG_BIN=$RUNNER_TEMP/hf-ffmpeg" >> "$GITHUB_ENV"