feat: video direct-to-R2 ingest — browser seals, worker probes off R2

POST /video/direct/init|complete: the browser seals (SPENC2) and PUTs
straight to object storage; the api HEAD-checks, registers the unprobed
asset and queues a probe job — video bytes never cross the api box.

Worker side: produce_job_claim widened to probe jobs (042), the runner
gains a probe lane (sealed fetch → SPENC1/SPENC2 open by magic → scratch →
ffprobe → metadata write-back → complete 100), worker storage reads SPENC2
frames via DIRECT_EC_PRIVATE_KEY (inherited through compose appenv), and a
ported ffprobe util. Probe rows carrying input_json fail instead of
stranding; the claim guard no longer strands probe rows as invalid.

apps/media-worker/src/producer/runner.test.ts

@@ -87,8 +87,14 @@ function doubles() {
       const storageKey = assetKeys.get(assetId);
       return storageKey === undefined ? null : { storageKey, mimeType: "audio/mp4" };
     },
+    async completeProbe() { /* probe completions are asserted in the pg-store suite */ },
   };
   const storage: ProduceObjectStorage = {
+    async getSealedObject(k) {
+      const body = objects.get(k);
+      if (body === undefined) throw new Error("not found");
+      return body;
+    },
     async getObject(k) {
       const body = objects.get(k);
       if (body === undefined) throw new Error("not found");