fix(live): long-GOP startup and bounded native HLS compatibility

[christopherklint97]

Summary

• Follow-up to merged PR fix(live): unblock long-GOP HLS and iPhone loading failures #81's bounded long-GOP and actionable-error fixes.
• Actual NFL REPLAY INFO HD probe delivered media, then all three immediate source reopens were rejected with upstream HTTP 403 within 0.81 seconds. Leave cancellable one- and two-second cooldown gaps while preserving the same three attempts, same mux/stitch state, strict seam proof, and unmodified byte/publication watchdogs.
• Cold browser startup also exhausted the 25-second authorization budget before HLS first publication. Align the bounded client authorization budget with the server's unchanged 45-second publication deadline plus five seconds for readiness response; preserve immediate 401/403 rejection and backend/player generation cancellation.

Verification

• RED→GREEN fake-clock source close/cooldown regression; no liveness refresh.
• RED→GREEN native HLS forty-second readiness regression; fifty-second hard abort, immediate authentication errors, and forty-nine-second pending authorization watchdog regressions.
• Real socket regression also proved the old three-second read timeout falsely truncates a valid H.264 TS body across a 3.5-second delivery gap. Use a bounded ten-second default in both worker and CLI, below the owner's unchanged fifteen-second source-silence deadline; the forty-five-second publication bound and strict seam validation remain unchanged.
• Bounded PyAV input discovery (one second / one MiB) preserves real media/truncated-body classification; worker/stitch: 27 passed. Focused silent-successor retirement/long-GOP integration: 2 passed.
• Latest full frontend: 380 passed; frontend/server typechecks, ESLint, build, and diff checks passed. Latest full local server: 462 passed / 1 failed / 11 skipped; only unchanged archive-seam assertion failed, retained below.
• PR fix(live): unblock long-GOP HLS and iPhone loading failures #81 packaged CI was green. Local disk full server run before this follow-up had 460 passed, 2 failed, 11 skipped (unchanged archive-seam assertion and loaded-host long-GOP readiness deadline); retain that failure record, do not call it a green full suite.
• Earlier real NFL candidate attempts failed acceptance due HLS→TS fallback. They are not counted as playback success.
• Real compatibility-HLS control using the actual app and affected channel passed 120.613 seconds: zero post-start waits/stalls/errors/endings/reloads/HTTP errors/freezes, media advance 119.491 seconds, minimum lead 3.767 seconds. This explicitly forced the existing bounded FFmpeg HLS buffer on the isolated candidate; it proves that delivery pipeline, not the unfinished native fallback wiring or physical iPhone.
• Native fallback is implemented through an isolated independently signed /api/live-compatible buffer (bounded existing FFmpeg pipeline, four channels), sibling cache and separate segment epochs. Native Apple/WebKit requests it after unavailable/failing primary; authentication failures remain terminal. Compatibility unavailability produces an actionable error rather than raw TS/retry spinner. Primary latches and invalid stale tickets remain unchanged.
• Chromium native-HLS with an Apple UA exercised real primary-501→compatible authorization, playlist and segment routing without raw TS, but FAILED playback acceptance: media decode error, zero decoded frames, ~119-second freeze. The actual UI displayed the actionable compatibility error/Retry instead of a spinner. This is retained as a failure; it is not physical WebKit/iPhone evidence. MSE/control pipeline pass does not override it.
• Independent review caught a silent-compatible startup watchdog loop. Third-context TDD fix now terminates the first compatible no-progress watchdog with Retry, preserves healthy reconnects and compatibility delivery, ignores obsolete recovery scopes, and allows explicit retry. Nine additional real-recovery timer regressions pass, including obsolete backend watchdog/native-error status writes; independent final differential re-review passed (no remaining findings). Physical iPhone acceptance remains unverified.

Release

Final review passed, CI 37493954706 passed all packaged tests and ARM64 build; merged main 61f52ee has the identical tree 40e551944beaac4f7c991be94db684b473e1c688 as CI checkout 87b9ca3. Loaded/smoked PyAV14.2.0 and worker/stitch imports (correct runtime /app/src path), fully recreated production. Running ARM64 image sha256:ef2475ce575d1a96679c000d133c6b2865f5342ef4dc84d5cc0eaf8633a43767. Initial smoke used incorrect /app/dist and failed before restart; corrected /app/src smoke and full recreation returned exit0.

Readback: /api/health200, index/service-worker/entry asset bytes match running image, persistent channel count unchanged238534. Cold readiness probe took694.605 seconds from probe start; retain slow-start caveat. Actual affected-channel compatible authorization/playlist200 and a published 1080p H264/AAC segment passed strict decode. This is production media-delivery verification, not native/physical-iPhone playback acceptance; native Chromium failure above remains a failure. No archive implementation changes.