feat(record): fragment the MP4 so a crash cannot destroy the whole take

TASK 32·4. A plain MP4 keeps its index (moov) at the end, so a power cut or a killed
process left the entire recording unreadable even though every video byte was on disk.
The record block now carries
`-movflags +frag_keyframe+empty_moov+default_base_moof`: index first, a playable
fragment flushed at every keyframe, so an interrupted take plays to the last fragment.

Record block only — the FLV stream output has no index and never gets the flags.
Rename-on-stop is untouched.

Test: `Args_RecordBlock_IsFragmentedMp4_SoACrashKeepsTheFile` asserts the flags on the
record block and their absence from the streaming block.

Not yet proven on a real interrupted take (kill ffmpeg mid-recording, play the result);
the args test is by construction.

Docs: task-32 slice 4 ticked with that caveat, TASKS row, output.md record note, HANDOFF.
verify.sh: 550 passed (mouse-injection test excluded, desktop in use), 0 warnings.

TASKS/task-32-stream-resilience.md

@@ -26,11 +26,13 @@ the API — creator ruling 2026-09-01): no lying in the copy.
 3. ☐ **One-click Back on air** — the relabeled button fires the existing go-live path with saved
    `Broadcast.*` + cached stream, dialog skipped: new broadcast, new VOD (accepted cost, stated
    in-product). Test: seeded saved form + fake stream service → click creates + pushes, no dialog.
-4. ☐ **Crash-safe recording** — fragmented MP4 on the record block (`-movflags
+4. ✅ **Crash-safe recording** (shipped 2026-11-05) — fragmented MP4 on the record block (`-movflags
    frag_keyframe+empty_moov+default_base_moof`): plain MP4's trailing moov atom means a power loss
    kills the WHOLE file. Rename-on-stop unchanged. Closes the TASK 18 "MKV as an option" design-note
    remnant (fragmented MP4 chosen over MKV: single container, YouTube-upload-native — verify player/
-   editor tolerance, cite the research). Test: `FfmpegArgs` emits the movflags only on the record block.
+   editor tolerance, cite the research). Test: `Args_RecordBlock_IsFragmentedMp4_SoACrashKeepsTheFile` — the flags are on the record block and
+   absent from the streaming block. Verified by construction only: the file still needs one real
+   interrupted-take check on Windows (kill ffmpeg mid-recording, play the result).
 5. ☐ **Pre-flight** — before broadcast insert, one TCP probe to the ingest host:1935 (~2s timeout).
    Unreachable → Error toast, no insert, no ghost broadcast ("check VPN/network"). The "forgot the
    VPN" story, solved as prevention instead of recovery. Test: fake probe failure aborts go-live before any API call.