MLT Driver Host: add verified video-only FFV1 lossless profile for semantic AV mux #253

Native SDK / Driver Host product gap

Motionwright now passes a real 32+1 source-bound Motion Canvas → semantic MLT intermediary E2E (motionwright main PR #90, 60 CI checks pass, 2026-10-10). Its existing pinned Semwright MLT lossless profile emits ffv1 + pcm_s16le; the provider's validate_render_media requires audio=true. Meanwhile the independently certified driver.mlt-video.av.mux explicitly rejects an input video when video_info.audio is true, because it requires a video-only FFV1 input plus a separately verified 48kHz stereo WAV.

This leaves an intentional contract gap: the authored semantic MLT multi-segment cut cannot be fed to the existing H.264/AAC mux without skipping MLT, fabricating an input, or reworking raw files outside the Broker. Motionwright must NOT do any of those.

Proposed upstream bounded capability

Add an explicit opt-in curated MLT render profile such as lossless-video-only producing Matroska FFV1 with no audio track (for example via pinned MLT consumer an=1), while retaining the existing lossless FFV1+PCM behavior unchanged for current consumers. The new profile must prove video=true, audio=false, exact width/height, rational FPS and independently decoded frame count before owner-root no-overwrite artifact publication and SHA-256 receipt. If FFprobe omits nb_frames, require an independent decoder/frame count gate; do not silently equate duration with exact frames.

Honor the Semwright Native SDK/Driver Host/Broker Policy boundary, immutable source revision, output root, existing filesystem grants, deterministic result profile, bounded memory/IO and FFV1 decoder compatibility. Add unit tests for wrong audio status, modified source, overflow, profile confusion, private paths, refused grants, output collisions and negative frame evidence; add a real 33-frame multi-segment FFV1 source/render E2E. No generic arbitrary command or unsandboxed ffmpeg execution from the consumer app.

After upstream CI and security review, consumers can intentionally re-pin Native SDK and assemble the already verified owner-bound audio through the existing driver.mlt-video.av.mux. Final H.264/AAC and human approval remain separate.

Source investigation: Semwright pinned 8fa1912, crates/driver-mlt-video/src/runtime.rs RenderProfile and validate_render_media, crates/driver-mlt-video/src/app.rs av_mux; Motionwright issue #91 tracks the separate foreground-only destructive close permission.