feat(record): fragment the MP4 so a crash cannot destroy the whole take

TASK 32·4. A plain MP4 keeps its index (moov) at the end, so a power cut or a killed
process left the entire recording unreadable even though every video byte was on disk.
The record block now carries
`-movflags +frag_keyframe+empty_moov+default_base_moof`: index first, a playable
fragment flushed at every keyframe, so an interrupted take plays to the last fragment.

Record block only — the FLV stream output has no index and never gets the flags.
Rename-on-stop is untouched.

Test: `Args_RecordBlock_IsFragmentedMp4_SoACrashKeepsTheFile` asserts the flags on the
record block and their absence from the streaming block.

Not yet proven on a real interrupted take (kill ffmpeg mid-recording, play the result);
the args test is by construction.

Docs: task-32 slice 4 ticked with that caveat, TASKS row, output.md record note, HANDOFF.
verify.sh: 550 passed (mouse-injection test excluded, desktop in use), 0 warnings.

Services/Encoder/FfmpegArgs.cs

@@ -43,6 +43,12 @@ public static class FfmpegArgs
             AddVideoTags(args, options, videoEncoder);
             args.AddRange(["-c:a", "aac",
                 "-ar", options.AudioSampleRate.ToString(), "-ac", options.AudioChannels.ToString()]);
+            // TASK 32·4: FRAGMENTED mp4. A plain MP4 writes its index (moov) at the end, so a
+            // power cut or a killed process leaves the video bytes on disk in a file nothing can
+            // open — the whole recording, not the tail. Fragmented writes the index first and
+            // flushes a playable fragment at every keyframe, so an interrupted file still plays up
+            // to the last fragment. Record block only: the FLV stream output has no index.
+            args.AddRange(["-movflags", "+frag_keyframe+empty_moov+default_base_moof"]);
             args.AddRange(["-f", "mp4", options.RecordPath!]);
         }