Add a GStreamer (moqsrc) subscriber to the media matrix

[kixelated]

Stacked on #4 (token interop). Base is token-interop-smoke; it touches some of the same files (smoke.yml, freshness.sh, justfile, README.md). Review/merge #4 first, then this retargets to main cleanly.

Why

moq-gst ships the moqsink/moqsrc GStreamer elements via apt (gstreamer1.0-moq), brew, rpm, nix, and release tarballs — but the only coverage was a gst-inspect load check in the moq repo. Nothing proved a real pipeline moves bytes end-to-end against the other implementations.

What

A gst subscriber cell. Like the C client, it downloads the latest moq-gst prebuilt tarball, points GST_PLUGIN_PATH at it, and confirms the plugin loads (gst-inspect) against the host's system GStreamer — the .deb/brew/tarball scenario, since the prebuilt plugin dynamic-links system libgstreamer. The subscriber runs:

moqsrc url=… broadcast=… ! filesink location=/dev/stdout

and grabs one byte — the same "did a frame's bytes arrive" bar and the same head -c 1 early-exit idiom as the rust subscriber (no decode). Subscribe-only for now; publishing via moqsink needs an encoder + request-pad muxing (a follow-up), mirroring how Swift/Kotlin/C are subscribe-only.

Current state: red, on purpose

No moq-gst release has been cut yet (no moq-gst-v* tag exists, so apt/brew/rpm/tarball have nothing to install). The cell marks itself broken (no moq-gst-v* release found) and fails only its own cells — like the Go cell. That red is the signal the smoke test exists to give: a real user can't install this yet.

The interop itself is validated locally: built from source (cargo build -p moq-gst) and pointed at via the new MOQ_GST_PLUGIN_DIR override, moqsrc reads a rust-published H.264 broadcast end-to-end:

  PASS  rust -> rust
  PASS  rust -> gst

Negative control (no publisher → moqsrc times out) and the broken-channel path (only gst cells fail, rest stay green) both verified. The cell flips green automatically once the first release ships.

Wiring

• CI (smoke.yml): system GStreamer installed on every runner (apt gstreamer1.0-{tools,plugins-base,plugins-good} / brew gstreamer) + gst added to the subscriber list.
• Freshness: asserts smoke.sh resolves the newest moq-gst-v* release (never pinned), mirroring the libmoq check.
• justfile: gst added to just full.
• Override: MOQ_GST_PLUGIN_DIR points the cell at a local cargo build -p moq-gst output, analogous to RELAY_BIN/MOQ_BIN.

Validation

• shellcheck clean on smoke.sh; actionlint clean on the workflow. (shfmt isn't CI-enforced and the existing smoke.sh already carries its compact one-liner-guard style; gst_prepare matches c_prepare exactly.)
• End-to-end pass, negative control, and broken-channel behavior all confirmed locally against brew GStreamer 1.28.3.

🤖 Generated with Claude Code