fix(media): keep local failures and reference ambiguity inconclusive

[halfaipg]

What And Why

Review and complete the preserved video-decoder fairness patch in an isolated branch. The original dirty worktree is unchanged. No media activation, tolerance changes, account changes, release or production deployment.

• Preserve a typed invalid-video result across the bounded decoder child boundary. Unknown/native/process failures stay inconclusive instead of becoming candidate failures.
• Narrow PyAV classification to explicit structural violations and InvalidDataError. The proposed broad FFmpegError catch also caught allocation failure, missing decoder and permission errors; those are local infrastructure failures, not proof of bad worker output.
• Check reference usability and agreement before any candidate failure in both image and video fidelity. Previously corrupt, blank/static or contract-invalid candidates could fail even with disagreeing or unusable references.
• Keep genuinely corrupt candidates failed when references agree; keep the local structural-only video contract behavior distinct.
• Run the media regression suite on every native binary target. Update nested DOX and the roadmap without claiming these fixes are in preview.12.

Verification

• Test-first reproduction against the preserved patch: five failing assertions plus five FFmpeg subtype errors, covering candidate/reference precedence and native allocation/missing-codec/permission/unknown-error misclassification.
• Fixed source: 253 tests pass, including 37 media tests. Generated local PNG/MP4 fixtures exercise the real bounded decoder processes. Controlled native exceptions prove classification and sanitized child messages; this does not simulate an actual exhausted OS.
• Offline CLI media self-test passes.
• Scoped Ruff lint and git diff --check pass. Full-file Ruff formatting already fails on both touched files in master; existing unrelated formatting is preserved, not claimed green.
• Staged Gitleaks and complete reachable HEAD scan pass (91 commits). A broad directory scan reports only local paths in ignored test bytecode/Ruff caches, not source credentials; no scan exclusions were added.
• Exact HEAD 21c64930a8d381dfec1eb6b18dc370ceba199c83: native release CI passed all four builds, the media regressions on Windows/macOS/Linux x64/Linux ARM64, packaged smoke, verified payload assembly and all four clean installs. Release publication was correctly skipped.
• Python matrix, Docker and dependency audit, CodeQL, and secret/infra scans passed. These are generated-fixture/offline tests, not production media calibration.

Limits And Rollout

This is dark scorer correctness, not live multi-GPU calibration, worker independence, fraud-proof model fidelity or a production media pilot. Governed recipes, independently controlled reference workers, real-workload calibration and supervised activation remain gated. Public preview.12 and production remain unchanged.

[halfaipg]

Final review refreshed on master including merged pairing #54 and preview.13 release fixes. Source suite: 284 run, 278 passed, 6 explicit opt-in skips; all six actual Core/Console HTTP integration tests passed separately. Full reachable-history Gitleaks: 96 commits, no findings. Native CI now includes the media regression suite on all four targets. The original dirty video patch remains byte-for-byte unchanged (SHA-256 7509705dc5a333e4c34c56ec32969f983bbdacdee193a34fd5ad7dedcd8ea3b0). This change does not enable media assignments or modify policy thresholds/economics. Native clean-install CI must pass at fac3784 before merge.