Sound cards end to end (iXML slate), proxies-first ordering, and run.py

[owenpkent]

Four changes that came out of a live 110 GB offload of a Blackmagic card.

Stacked on #4, so it targets fuzz-edge-cases. Review that one first.

Sound recorder cards are a first-class offload

The media profile already probed .wav/.aif/.bwf, so a sound card copied and
verified fine. What it could not do was describe itself: the summary read
(0 video), the report was a picture report with the interesting fields blank,
and the one field a sound report is actually read for was dropped on the floor.

• Counts stay disjoint. is_audio is "no picture", not "has sound", so a
  clip with dialogue is counted once as video and the two numbers still add up
  to something a reader can check. (48 audio), or (54 video, 12 audio).
• The header cell adapts rather than grows. The reference grid is exactly
  four rows deep with strict zips, so a sound card borrows the Video Files
  cell. Every coordinate is unchanged, and Video Files: 0 stops being the one
  number on the page that tells the reader nothing.
• Timecode off the BWF. time_reference is the sample count since
  midnight; divided by the sample rate it gives the start clock. It renders
  10:00:00.000, not 10:00:00:00, and that is deliberate: the frame rate
  needed to convert the remainder lives in iXML, which ffprobe cannot read.
  Printing frames would mean picking a rate at random and showing a guess in
  the field the report exists for.
• Format reads as sound. Bit depth from bits_per_raw_sample, falling back
  past the zero several compressed codecs report. A clip's own audio line is
  left exactly as the reference renders it, so picture reports still match
  ShotPut digit for digit.

Thumbnails needed no change: the engine already gates them on is_video and
the layout already swaps the contact sheet for a filmstrip glyph.

Verified end to end against real broadcast WAVs written with a bext chunk,
not only against captured-shape JSON.

Copy proxies before the originals

Camera proxies are a rounding error next to the originals: the card that
prompted this is ~110 GB of BRAW against ~0.4 GB of H.264. Moving them first
costs well under a percent of the job's runtime and hands the edit something to
cut with minutes in. It also improves the contact sheet, which I did not expect
going in: BRAW thumbnails are borrowed from the matching proxy, and
companions.thumbnail_source checks the destination before the source, so
that read now comes off the destination disk instead of competing with the copy
for the card.

Transfer order and report order are now separate concerns. Simply walking
the reordered list would also have reordered job.files, so the contact sheet
would have opened with the proxy folder and buried the clips: an I/O
optimisation paying for itself with a worse report. run sorts the rows back
into tree order, and a test asserts rows and checksums come out identical
whichever order the job ran in.

rescan is untouched: report copies nothing, so ordering there is purely
report order. --originals-first restores the old order, and presets saved
before the option existed inherit the new default.

run.py

python run.py opens the desktop app; python run.py <anything> forwards to
the CLI untouched, exit codes included. It prepends src/ to the import path,
so a checkout beside an older pip install offloader runs the code you are
looking at rather than site-packages.

The sound slate, from iXML

ffprobe does not surface the iXML chunk at all, so every field a sound report
is read for was invisible. offloader.ixml walks the RIFF chunks directly, the
way braw walks the moov atom, for a few seeks and a few KB. It is only
entered for a WAV with no video stream, so a card of camera originals never
opens a file for it.

It settles the timecode question the commit above had to leave open.
Printing frames needs three things and no one chunk has all three: the origin
(bext, and again in iXML), the sample rate (fmt ), and the frame rate,
which only iXML carries in SPEED/TIMECODE_RATE. With it, a take renders
10:00:00:00 NDF. Without it the millisecond clock stays, for the reason it
was chosen.

The PDF reads Roll SR082226 · Scene 12A · Take 3 CIRCLED over
Boom, Lav 1 LINEAR PCM 48 kHz 24-bit — naming the channels beats
describing their shape, and costs no extra line. The metadata block has seven
baselines and a fully-slated take fills all seven; report-layout.md claimed
five, which was stale.

The CSV gains Recorder, Project, Track Names and Note, and fills the
existing Reel/Scene/Take/Good Take from whichever department wrote the
slate, so one column keeps meaning one thing.

A card is untrusted input

A WAV truncated by a battery dying mid-write must not take the offload down
with it. Each of these has a reproduction in tests/test_ixml.py:

• every step of the walk advances, so a zero-size chunk cannot pin it
• the payload is capped, so a corrupt size field is not an allocation
• RF64's ds64 sizes are honoured, so an iXML chunk filed after 4 GB of audio
  is still reachable
• Wave64 is declined rather than misread — its GUID chunk identifiers would
  parse as garbage here
• a doctype or entity declaration is refused outright, closing
  billion-laughs and XXE without taking on defusedxml as a dependency
• iXML text is escaped on its way into the HTML report

Fixtures are built by tests/bwf.py rather than shelled out to ffmpeg, which
cannot write an iXML chunk at all — so the parser is tested without ffmpeg on
PATH.

---

Updated totals: 597 passing (+115 over the base), ruff clean.