Tactical Media Broadcast Hub — initial release

Self-hosted multi-platform broadcast newsroom for activist collectives:
publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style
column wall with hostile-content-safe rendering, live control room with Auto
Director, bridged chat governance with polls and quorum, distributed sandboxed
transcode workers, encrypted content-addressed archive, monthly analytics.

MIT licensed. See README.md and docs/.

apps/media-worker/scripts/build-helpers.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+# Deterministic release build of the native helpers (src/gate/rust: frame-gate, source-bus).
+#
+#   scripts/build-helpers.sh [OUT_DIR]      (default: apps/media-worker/bin)
+#
+# std only, no crates: `--offline --locked` needs no network and fails if Cargo.lock would change.
+# Reproducible for a given rustc: the crate path is remapped out of the binary, symbols are
+# stripped, and the build uses its own target dir (the development target/ is left alone).
+# OUT_DIR gets the two binaries plus SHA256SUMS; the worker finds them via MEDIA_HELPER_DIR
+# (src/gate/binary.ts). The image builds this in a pinned rust stage (infra/media-worker.Dockerfile).
+set -eu
+here=$(cd "$(dirname "$0")/.." && pwd)
+crate="$here/src/gate/rust"
+out=${1:-"$here/bin"}
+target=${CARGO_TARGET_DIR:-"$crate/target/package"}
+export CARGO_TARGET_DIR="$target"
+export RUSTFLAGS="--remap-path-prefix=$crate=/frame-gate -C strip=symbols -C debuginfo=0"
+cargo build --release --offline --locked --manifest-path "$crate/Cargo.toml"
+mkdir -p "$out"
+for bin in frame-gate source-bus; do
+  install -m 0755 "$target/release/$bin" "$out/$bin"
+done
+(cd "$out" && sha256sum frame-gate source-bus > SHA256SUMS && cat SHA256SUMS)
+rustc --version > "$out/RUSTC_VERSION"

apps/media-worker/scripts/nightly-soak.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+# Reference-host nightly entry point. Eight hours; nonzero means a gate/leak failure.
+# Usage: sh scripts/nightly-soak.sh [JSONL_OUTPUT_PATH]
+set -eu
+worker_dir=$(cd "$(dirname "$0")/.." && pwd)
+repo_dir=$(cd "$worker_dir/../.." && pwd)
+out=${1:-"$repo_dir/runs/soak/$(date -u +%F).jsonl"}
+mkdir -p "$(dirname "$out")"
+cd "$worker_dir"
+sh scripts/build-helpers.sh
+export MEDIA_HELPER_DIR="$worker_dir/bin"
+exec node --import tsx src/compositor/soak.ts --hours 8 --profile 1080p30 --swap-every 30 --sample-every 10 --out "$out"