feat(65): the replay layer exists in the model; the exclusion problem is solved by the guard

Slice 5a, scaffolding only. 607 green.

- `Source.IsReplayLayer` + schema column + roundtrip: a media layer that shows saved clips instead of a
  chosen file. The compositor needs to know nothing — it is a media layer whose path the VM owns.
- **Two spec corrections from the creator (2026-11-10), recorded in the task:**
  1. The immediate replay of a fresh clip happens **only in the Live scene**. While it plays, **F10 is
     inert** ("replay in progress").
  2. That guard replaces the "layer excluded from its own clip" idea, which is **impossible** with one
     encoder and two muxes: the clip is a second mux of the same frames, so it necessarily contains what
     viewers saw. No second encode, no fiction about a clean feed.

Remaining for 65: the add-layer menu entry, `ClipSaved` → play (Live: once then hide; elsewhere: loop the
kept set), `SessionCompleted` → advance or hide, and silent-by-default audio.

TASKS/task-65-replay-clips.md

@@ -31,6 +31,11 @@ never the creator, who cannot reach a keyboard mid-moment).
 
 ## The replay layer
 
+**Scope settled 2026-11-10:** the immediate replay of a fresh clip happens **only in the Live scene**.
+While that replay is playing, **F10 is inert** ("replay in progress") — that is what replaces the
+hall-of-mirrors exclusion, which is impossible with one encoder and two muxes: the clip *is* what the
+stream got.
+
 One layer type, added by the creator to the scenes they want; behaviour comes from the scene:
 
 | Scene | Behaviour |
@@ -40,8 +45,9 @@ One layer type, added by the creator to the scenes they want; behaviour comes fr
 
 - **Audio off by default**, toggleable per layer. The show's sound design is the creator's; a replay
   should not re-mix it uninvited.
-- **The replay layer is excluded from the clip's own composition.** Otherwise saving while a clip plays
-  records a video of a video (hall of mirrors). Viewers still see it live; the clip simply doesn't.
+- **No exclusion, no second encode.** The clip is a second mux of the frames the stream already got, so
+  it contains whatever viewers saw. Double-clipping is prevented instead: F10 does nothing while the
+  Live replay is playing.
 
 ## Storage and retention