branding credit: run in every scene and in recordings, not only while live

Creator 2026-09-26: "the made with llamacasty flash should appear in all scenes,
not just live" and "should also appear in recordings". The presenter was
Start()/Stop()-ed from UpdateLiveVisuals()'s IsLive branch, so a recording made
WITHOUT ever going live carried no credit at all -- the exact case the creator hit
while judging compositing from local recordings.

It is now Start()ed once in the MainViewModel ctor and never stopped on live-state
churn. One start covers every scene, the preview, the stream and the recording,
because go-live and local recording are the SAME FramePump: both
Streaming.Operations.cs:68 and :199 call StartAsync with the same brandFlash:
delegate. Verified by reading both call sites, not assumed -- there is no second
encoder path that needed a "redirect". The licence gate needs no live branch at
all: IsPremium's setter already pushes BrandFlashPresenter.Enabled from anywhere.

Fixed a trap that app-lifetime exposed: Enabled = false stops the presenter's
DispatcherTimer to cut the advertisement mid-credit. When Start() was per-go-live
the next go-live restarted it; with a single app-lifetime Start() nothing would,
so a key entered mid-session would leave the credit dead until the process was
restarted. The setter now restarts the timer when re-enabling while _running.

Tests (12 facts in BrandFlashOutputTests, +2):
  Credit_IsComposited_WithNoLiveSession_AndSoARecordingCarriesIt -- drives a real
    never-live VM past the 5s first-flash delay and asks the frame the pump would
    composite. Uses a new internal AdvanceBrandFlash seam; because Advance only
    advances the cadence while the presenter is running, a credit coming out
    proves Start() happened at construction.
  ADowngradeMidSession_RestartsTheCadenceTimer -- asserts the premium/downgrade
    edge decision directly (IsCadenceTimerEnabled) instead of sleeping through a
    30-60s interval, which a synchronous test body cannot observe.

Full suite 364/364.

TASKS.md

@@ -79,9 +79,13 @@ second encoder path needing a "redirect". Record+simulcast is one ffmpeg with tw
 1. ✅ **Recording save dialog: Cancel discards** — was silently saving under the default name. Enter
    accepts the default; Cancel/Escape/X **deletes** the footage and names the file if the delete fails.
    `MainViewModel.CompleteRecordingSave` (internal) + `ytLive.Tests/RecordingSaveDialogTests.cs`.
-2. ☐ **Brand flash must run in ALL scenes, not only while live, and must be in recordings.** Currently
-   started/stopped from `UpdateLiveVisuals()`'s `IsLive` branch, so recording-only (never go-live)
-   shows no credit at all. Ungate the presenter from `IsLive`; the pump already carries it to both.
+2. ✅ **Brand flash in ALL scenes + in recordings** — was gated on `IsLive` via
+   `UpdateLiveVisuals()`, so a recording made without ever going live carried no credit. The
+   presenter is now `Start()`ed once in the `MainViewModel` ctor and never stopped on live-state
+   churn; the licence gate rides on `IsPremium` → `Enabled` as before. Also fixed the
+   premium-edge/restart trap that app-lifetime exposed. Tests: `BrandFlashOutputTests`
+   (12 facts) incl. `Credit_IsComposited_WithNoLiveSession_AndSoARecordingCarriesIt` and
+   `ADowngradeMidSession_RestartsTheCadenceTimer`.
 3. ☐ **Ticker confined to the alert box.** The announcement strip is a **global 1920×48 top overlay**
    (`AlertOverlayLayer` comment + `BlitOverlay(…, 0, 0)`), but the creator wants it over the *Stream
    Alerts video* — i.e. inside the `SourceType.AlertBox` rect, in preview AND output. Needs a rect