feat(04-08): video-file MediaStream + sync-install/lazy-first-frame + explicit WAR — methodology reframe per debug session-2 + iter-2 BLOCKER fixes

Task 1 of Plan 04-08 (methodology reframe of ROADMAP SC #1):

- Bundle 1.9 MB VP9 WebM fixture at tests/uat/fixtures/synthetic-display-source.webm (copy of internal Plan 01-07 fixture; CC0-equivalent project-owned)
- Add globals.d.ts ambient `*.webm?url` module decl (mirrors Plan 01-10 `*.svg?url`)
- Add manifest.json web_accessible_resources entry for `assets/*.webm` (iter-2 BLOCKER 1 — pre-decided to avoid executor improvisation; inert in production where dist/ has zero *.webm)
- Rewrite installFakeDisplayMedia() at src/test-hooks/offscreen-hooks.ts:
  * Replace canvas.captureStream(30) with HTMLVideoElement.captureStream(30) — bypasses Chrome bug 653548 invisible-canvas throttling (debug session-2 root cause)
  * Function signature remains SYNCHRONOUS (`: void`; iter-2 BLOCKER 2 — eager-install contract preserved at lines 528-537)
  * Video element creation + DOM append + monkey-patch assignment execute synchronously
  * canplay wait + .play() deferred INTO fakeGetDisplayMedia closure (lazy first-frame pattern)
  * fakeVideoReadyPromise kicked off at install time so first call observes resolved Promise
  * WARNING 1 (autoplay reject): explicit error class identifier 'autoplay-blocked or codec-unsupported in headless context'
  * displaySurface monkey-patch preserved verbatim
  * A23 lastGetDisplayMediaConstraints capture preserved
  * uninstallFakeDisplayMedia teardown adapted for videoEl (pauses + removes + nulls)
  * All 6 bridge ops UNCHANGED in their sync return-false form
- Add Tier-2 production-bundle filename-leak gate at tests/background/no-test-hooks-in-prod-bundle.test.ts (iter-2 WARNING 5 — synthetic-display-source string must be 0 hits in dist/)

Verification:
- npx tsc --noEmit: exit 0
- npm run build: dist/ produced; 0 *.webm files; 0 synthetic-display-source hits
- npm run build:test: dist-test/assets/synthetic-display-source-mbtR1t3u.webm emitted (1.9 MB; Vite ?url asset)
- Code-only grep (comment-filtered) on offscreen-hooks.ts: 0 canvas refs; 15 video refs
- installFakeDisplayMedia signature unchanged: `: void` 2x; `: Promise` 0x; `await installFakeDisplayMedia` 0x
- Architectural invariant unchanged: `let segments: Blob[] = []` at recorder.ts:91 (1 hit; grep gate enforces)
- Tier-1 FORBIDDEN_HOOK_STRINGS unchanged at 12 entries
- Tier-2 vitest gate PASSES: 14/14 GREEN under SKIP_BUILD=1 (12 Tier-1 + 1 build verify + 1 Tier-2)

Per iter-3 checker advisory 1: the wrong-display-surface throw lives at recorder.ts:313-321 (not line 294 as plan text states; off by ~25 lines but unambiguous).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/background/no-test-hooks-in-prod-bundle.test.ts

@@ -293,4 +293,60 @@ describe('production bundle has no test-hook leaks (Tier-1 gate — T-1-11-01)',
       ).toBe(0);
     });
   }
+
+  // Plan 04-08 iter-2 WARNING 5 — Tier-2 production-bundle filename leak canary.
+  //
+  // The test-only WebM fixture filename ('synthetic-display-source')
+  // appears in the TEST bundle as the resolved Vite hash URL but MUST
+  // NOT appear in the PRODUCTION dist/ bundle. The offscreen-hooks
+  // module that imports it is tree-shaken in production per
+  // __MOKOSH_UAT__; this gate catches any future regression that
+  // accidentally inlines test-hooks into the production chunk.
+  //
+  // The Tier-1 FORBIDDEN_HOOK_STRINGS inventory above tests __mokoshTest-
+  // family symbols; this Tier-2 gate tests the orthogonal axis of
+  // test-only ASSET filenames. Total inventory:
+  //   Tier-1 (symbols): 12 entries (unchanged from Plan 01-14)
+  //   Tier-2 (asset filenames): 1 entry (Plan 04-08 — synthetic-display-source)
+  //
+  // Note: the import is `tests/uat/fixtures/synthetic-display-source.webm?url`
+  // and Vite emits the asset to `dist-test/assets/<hash>.webm` only when
+  // the test bundle (vite.test.config.ts) is built. The production bundle
+  // (vite.config.ts) tree-shakes the entire offscreen-hooks.ts module
+  // body because `__MOKOSH_UAT__ === false` makes the dynamic import a
+  // static dead branch in src/offscreen/recorder.ts:46-48. Result: the
+  // filename string `synthetic-display-source` MUST be absent from every
+  // file under dist/.
+  it('Tier-2: synthetic-display-source filename does not leak into production dist/', () => {
+    if (!existsSync(DIST_DIR)) {
+      throw new Error(
+        `dist/ missing — run \`npm run build\` first (SKIP_BUILD=1 is set but no prior build artifact exists).`,
+      );
+    }
+    // Walk dist/ files via the existing recursive walker (which skips
+    // symlinks); the existing countOccurrencesInFile helper handles
+    // binary-extension skipping. Grep for the literal string
+    // 'synthetic-display-source'. Expected: 0 hits.
+    const distFiles = listAllFilesRecursive(DIST_DIR);
+    const offendingFiles: Array<{ filePath: string; count: number }> = [];
+    for (const filePath of distFiles) {
+      const count = countOccurrencesInFile(filePath, 'synthetic-display-source');
+      if (count > 0) {
+        offendingFiles.push({ filePath, count });
+      }
+    }
+    expect(
+      offendingFiles.length,
+      offendingFiles.length === 0
+        ? 'unreachable'
+        : `Production bundle contains 'synthetic-display-source' filename in ${offendingFiles.length} file(s) — ` +
+            `this would leak the Plan 04-08 test-only WebM fixture filename to production. ` +
+            `The offscreen-hooks.ts module that imports the WebM via Vite ?url should be ` +
+            `tree-shaken in production per __MOKOSH_UAT__; if the filename appears, the ` +
+            `tree-shake has regressed. Offending files:\n` +
+            offendingFiles
+              .map((m) => `  - ${m.filePath} (${m.count} occurrence${m.count === 1 ? '' : 's'})`)
+              .join('\n'),
+    ).toBe(0);
+  });
 });