feat(topbar): REC/ON-AIR pills are radio-exclusive (record-OR-live)

The record-OR-live ruling (2026-09-01) was documented in ai.md but the
'pills = radios' UI constraint never landed — both pills could be armed and
StartSession/BuildEncoderOptions would dual-encode to the YouTube ingest AND
a local file at once, streaming a concurrent disk write off the same ingested
Kbps (cripples the stream on mid-range chassis; 'the VOD is already the copy').
The pill setters now clear one another (silent mutual clear); the dual-block
ffmpeg machinery stays generic and unreachable from the UI by design.

ViewModels/MainViewModel.Streaming.cs

@@ -33,8 +33,10 @@ public partial class MainViewModel : ViewModelBase
     private double _recDotPulse = 1.0;
     private TimeSpan _liveElapsed;
 
-    // ─── Recording (TASK 18): independent REC / ON-AIR pills. The pills are
-    // ─── intent; IsRecording / IsLive are reality. ON-AIR needs a sign-in.
+    // ─── Recording (TASK 18): REC / ON-AIR pills — the pills are intent;
+    // ─── IsRecording / IsLive are reality. ON-AIR needs a sign-in, and the
+    // ─── pills are radio-exclusive (record-OR-live, creator ruling 2026-09-01):
+    // ─── arming one clears the other.
     private bool _recordPillOn;
     private bool _onAirPillOn;
     private bool _isRecording;
@@ -85,6 +87,7 @@ public partial class MainViewModel : ViewModelBase
         set
         {
             if (!SetProperty(ref _recordPillOn, value)) return;
+            if (value && _onAirPillOn) OnAirPillOn = false; // record-OR-live — arming REC drops ON-AIR
             OnPropertyChanged(nameof(ShowPrimaryStartButton));
             OnPropertyChanged(nameof(CanStartSession));
         }
@@ -97,6 +100,7 @@ public partial class MainViewModel : ViewModelBase
         {
             if (value && !CanToggleOnAir) return; // needs a sign-in
             if (!SetProperty(ref _onAirPillOn, value)) return;
+            if (value && _recordPillOn) RecordPillOn = false; // record-OR-live — arming ON-AIR drops REC
             OnPropertyChanged(nameof(ShowPrimaryStartButton));
             OnPropertyChanged(nameof(CanStartSession));
         }