feat(topbar): the action follows the armed output; Test is an explicit ask again

Unit C (creator ruling 2026-11-12).

- Local MP4: one button, "Start Recording".
- YouTube: "Private Test Stream" beside "Review & Go Live", the latter with the primary face because it
  is the default ask.
- Running: "End Live Stream" (or "End Test" for a test run, "Stop Recording" for a local one).

The behavioural change underneath: SessionStartDecision.For no longer takes `editing`. Since 2026-10-30
EDIT silently chose test-vs-real, which meant the same button did two different things depending on a
toggle three inches away. With Test as its own button that inference has no job, so For() now reads only
the armed output and ON-AIR always means the real livestream. That supersedes the 2026-10-30 ruling;
SessionStartDecisionTests is rewritten to pin the new matrix rather than the old one.

A signed-out press still starts the sign-in flow instead of sitting dead (no-dead-ends), unchanged from
before — now stated in one place, the two new commands, instead of inside a route table.

680 pass, 0 warnings. Scope justification: Assets/starting-background.jpg is outside this unit — the
creator's replacement art, still awaiting their visual check.

docs/ai/ui-surface.md

@@ -157,7 +157,14 @@ Placement math itself is covered by `WindowPlacementTests` (pure function, no HW
   its glyph, with **Local MP4 armed at launch** (`RecordPillOn` starts true — it did not before). The two
   are one axis and the view model already drops one when the other arms, so exclusivity is policy, not
   layout. A running session hides the stage (its output cannot change) and the reality line plus the
-  stop action take the cluster's place. Next in the same redesign: the output-dependent primary action.
+  stop action take the cluster's place.
+- **The action follows the armed output** (creator ruling 2026-11-12). Local MP4 → `Start Recording`
+  (`Stop Recording` while running). YouTube → `Private Test Stream` beside `Review & Go Live`, the latter
+  carrying the primary face because it is the default ask. **Test is no longer inferred from EDIT** — the
+  2026-10-30 rule where COLLECT EDIT decided test-vs-real is superseded, and `SessionStartDecision.For`
+  takes only the armed output. Running: `End Live Stream` (or `End Test` for a test run, `Stop Recording`
+  for a local one) via `EndButtonText`. A signed-out YouTube press starts the sign-in flow rather than
+  sitting dead (no-dead-ends).
 - **Editing during a session is a setting (creator ruling 2026-11-12).** `App.LockEditWhileLive` is off
   by default: a show does not take EDIT away, so a creator may move a layer or resize a webcam while
   live. On restores the old gun-safety — go-live flips EDIT off, stop flips it back, and only because