feat(native): add community extras and media preparation

[kalvinnchau]

Summary

• Route invite minting and relay-advertised GIF search through the native relay adapter.
• Prepare HEIC and supported video/voice-note input in the native host before authenticated upload. Keep fixed demuxers, private temporary storage, two-slot admission, bounded subprocesses and shared upload response policy.
• Preserve full HEIC tile grids in both conversion hosts; hide Windows ffmpeg consoles.
• Let the frontend own container recognition; native code accepts only fixed mode/demuxer pairs. Remove the unused native HostedCommunities identity read.
• Pin modern ffmpeg/ffprobe through Hermit so Linux hosted conversion tests execute and fail if tools are missing.

Validation at 2ab800d1ec4cdf89dbb599b2113cb33287b9fd17

• Rebased onto main 329fe2a1; remote head verified.
• Full buzz-foundation package: 192 unit tests and 1 integration test passed; 4 pre-existing ignores. Doctests passed.
• Mandatory pre-push: TypeScript, all selected Vitest (455 files / 5582 tests), design-system checks, workspace all-target Clippy with -D warnings passed.
• Synthetic six-tile HEIC fixture: both actual preparation paths produce 1536×1024 JPEGs. Restoring -map 0:v:0 made both regression tests fail with 512×512, then restoring fixes passed. Mutation evidence was before the rebase; unchanged conversion code also passes afterward.
• Native tests cover pre-spawn cancellation, active-child cancellation/deadline/output-size kill, two-slot admission/release, missing-tool 503, and private temp permissions.
• One earlier full Rust run hit the existing terminal Ctrl+C failure; subsequent full runs passed without modifying terminal code. One interim Vitest run exposed the obsolete native-identity test; that test was removed together with its inert implementation, restoring HostedCommunities to the base.
• Windows conversion tests are explicitly ignored without ffmpeg; no silent early-return passes. Windows native validation dispatched: https://github.com/block/buzz-app/actions/runs/36669037004
• Older/unknown host ffmpeg versions now fail closed before HEIC conversion; release n prefixes are accepted. Native probe is bounded to 4096 bytes and 5 seconds, cancellable, and hides Windows consoles.
• Native old-version coverage calls the real preparation path with a host-owned executable; broker tests prove old versions never convert/deliver and n9.0.2 can deliver.
• Explicit ffmpeg/ffprobe CI provisioning now occurs before timed tests. Earlier hosted JavaScript timed out on the conversion test at 2798882c; earlier Windows Clippy failed on Unix-only builder mutability. Both are fixed; hosted JavaScript and Windows validation now pass.
• All automatic hosted checks pass at this head: JavaScript, Rust/tool integration, browser measurements, all 12 browser shards, CI required, Semgrep, zizmor and DCO. Windows dispatch 36669037004 also passed; real Windows conversions are explicitly ignored there. Peon independently approved the fixes at this head in the originating Buzz thread (agent review only; correctness/minimalness/elegance 9/10 each).

Pending before readiness

• Packaged-app/live-relay exercise and human validation per AGENTS.md. This PR remains draft. No merge/release claim.
• Windows console behavior still needs a real GUI-host exercise. Windows CI does not run real conversion tests.
• Optional invite-error wording and repeated GIF discovery suggestions are deferred; no related redesign in this correction.

Manual check

Run the desktop app against a test community with modern ffmpeg installed. Mint an invite, search/select a GIF, and upload tests/fixtures/media/tiled.heic and a supported video. The HEIC must render as the full 1536×1024 picture, not a 512×512 corner; reopen the conversation and verify attachments. Cancel a running conversion and verify no attachment uploads. On Windows, verify no ffmpeg console appears. A human must explicitly confirm these checks before readiness.

[wesbillman]

One change needed: restore the broker’s warning-free Vite config boundary (inline finding).

Star Lord’s automated source review via Wes’s account (wesbillman). Head 49472fcca71700a3f564e43ffbed6d78be865b1a; base 9cdb328319a837d306cccf73070e192d4ccee8b8. Source-only, including an independent Rust lifecycle/IPC review; we executed no code or tests. Hosted JavaScript/required CI fails as cited inline. Packaged-app, live-relay and human acceptance remain unverified; this is not approval or merge authorization.

[wesbillman]

No further changes requested: the dependency-free GIF capability module and direct broker import address the previous finding, with the warning assertion preserved.

Star Lord’s automated source review via Wes’s account (wesbillman), head 8b71ab5da52d30fc4f2aaf478d959830d4d69249, base 4e1cf4b8fc93088fad7110e63e6681cc3aa4e322. This source-only follow-up checked the repair and rebase integration; no code or tests were executed locally. Hosted required CI passes, but Windows was skipped and packaged-app, live-relay, cross-account and human acceptance remain unverified—not approval or merge authorization.

[wesbillman]

No new changes requested in this conversion follow-up: the HEIC grid fix, bounded version probe and tool provisioning preserve the reviewed upload contract.

Star Lord’s automated source review via Wes’s account (wesbillman), with independent native-lifecycle review; head 2ab800d1ec4cdf89dbb599b2113cb33287b9fd17, base 329fe2a1de0ad7f9aa8eebbc02e1a957bcafa25d.

Hosted required CI and Windows validation pass, but real Windows conversions are explicitly ignored. We ran no code or tests; packaged-app/live-relay behavior, Windows GUI-console behavior and human acceptance remain unverified—this is not approval or merge authorization.