fix(macos): enumerate audio devices natively to avoid hotplug UAF

[errrepe]

Problem

Harbor 0.9.21 crashes with SIGSEGV on macOS when a CoreAudio device-change notification races mpv's audio hotplug teardown. Crash signature (thread on HALC_ProxyNotification Call Listener Queue):

• hotplug_cb (audio/out/ao_coreaudio.c) receives a struct ao * as its listener context and immediately calls MP_VERBOSE(ao, "Handling potential hotplug event...") → mp_msg(ao->log, ...)
• If the ao was already freed while the notification was still queued (AudioObjectRemovePropertyListener does not drain in-flight callbacks), ao->log reads 0 and mp_msg_va dereferences address 0x0
• Upstream bug, unfixed in mpv master: macOS: SIGSEGV in ao_coreaudio hotplug_cb (null deref in mp_msg_va) on audio device change mpv-player/mpv#18274 (mpv 0.41.0, macOS 27)

Reading audio-device-list makes libmpv register that listener — on a throwaway Mpv, on the live session, and via probe AOs inside ao_hotplug_get_device_list. Every one of those frees is a race window whenever a Bluetooth/HDMI/dock device event is delivered.

Approach

On macOS, mpv_audio_devices no longer reads audio-device-list at all. New audio_devices_mac.rs enumerates output devices through the CoreAudio HAL (AudioObjectGetPropertyData) — the same queries mpv's ca_get_device_list performs, producing identical values:

• name = "coreaudio/<kAudioDevicePropertyDeviceUID>"
• description = kAudioObjectPropertyName (or "Unknown")
• same "has output" filter via kAudioDevicePropertyStreamConfiguration on the output scope

Names stay compatible with mpv_set_property("audio-device", ...). Since the native path registers no listener, the enumeration-side crash surface is removed entirely. Linux/Windows keep the previous behavior (live session first, then the long-lived probe context added in #1177).

Verification

• cargo check — clean, no new warnings
• Standalone replica of the FFI enumeration compiled and run on this machine (macOS 27, Apple Silicon): lists real output devices (coreaudio/BuiltInSpeakerDevice, monitor outputs) with the same names mpv reports, and filters input-only devices
• pnpm run check / vp check was not runnable in this environment (no pnpm/node_modules); the change is Rust-only

Platform Impact

• macOS: mpv_audio_devices no longer touches libmpv for enumeration
• Windows / Linux: unchanged

Checklist

• This pull request is focused and contains no unrelated refactors.
• I ran vp check for the changed files. (Rust-only change; cargo check clean. vp toolchain unavailable in this environment.)
• I ran vp run typecheck after TypeScript changes. (no TypeScript changes)
• I ran the relevant Cargo checks after Rust changes.
• I tested affected platforms when the change is platform-specific. (macOS enumeration verified against real devices)
• I preserved playback, navigation, and configured hotkey behavior where applicable.
• I added or updated tests for behavior changes. (no existing test harness for mpv commands; enumeration verified manually — see above)
• I removed secrets, tokens, private URLs, and personal data from logs and screenshots.

Note: the playback AO still registers hotplug_cb inside libmpv itself, so the same UAF remains possible on track/device changes until mpv fixes it upstream or we carry a patch on the bundled libmpv.2.dylib. This PR removes the enumeration-triggered path, which is the one we control.

Generated with Devin