fix(linux): harden WebKitGTK media, audio and rendering

[cmdr-chara]

Summary

Fix Linux/Tauri WebKitGTK compatibility issues observed on Arch/Omarchy without changing system drivers or global environment configuration.

Media and rendering policy

• Auto (recommended): static theme poster + separate theme audio, normal visual effects.
• Performance: static poster + separate theme audio with reduced blur/decorative animation.
• Quality: native WebKit/GStreamer theme-video streaming with full effects.
• Linux video is never Blob-buffered. Quality and non-theme video retain native streaming/Range behavior.
• Custom-scheme audio still uses a fetch() → blob: bridge because WebKitGTK/GStreamer cannot reliably play tauri:, themeprot:, or packet: audio directly.
• Menu music has a Linux-only coordinator that coalesces duplicate same-source loads/plays, safely invalidates superseded requests, and prevents the initial poster fallback/navigation race.
• Built-in SFX retain shared Blob caching and cleanup.

Startup stability

• A Linux-only WebKitGTK graphics guard runs before the WebKit process is created.
• Auto mitigation activates only for the observed mixed-vendor risk shape: Intel/AMD DRM hardware, no NVIDIA DRM hardware, but native-architecture NVIDIA EGL/gpucomp userspace libraries present.
• In that case, Auto pins GLVND to the discovered Mesa EGL vendor JSON instead of globally disabling DMA-BUF.
• Real NVIDIA systems, clean Mesa systems, existing WebKit/EGL overrides, and explicit PRIME/GPU routing are preserved.
• Startup diagnostics explicitly report renderer transport, compositing override state, render-device override, EGL vendor selection, and the policy reason.
• Reversible troubleshooting override: DELTAMOD_LINUX_WEBKIT_RENDERER=native|shm|disable-dmabuf.

UI compatibility

• Linux-only dark native form-control normalization, including <select> rendering.
• Pixel-oriented smoothing is scoped to intentional Pixel UI; normal copy keeps antialiasing.
• Options → Interface exposes a localized Linux rendering-mode selector with English fallback copy for untranslated catalogs.
• When Quality falls back to poster/audio, the selector reports that fallback for the current theme and its reason without changing playback policy.

Regression coverage

• Auto/Performance poster-first behavior.
• Quality native streaming with zero video Blob creation.
• Codec-unavailable and unhealthy-video fallback.
• Linux menu-audio duplicate-play/source-switch race handling and Blob lifetime.
• Reusable SFX behavior and audio Blob cache/cleanup.
• Localized Linux mode control and visible Quality fallback status.
• Mixed-vendor startup guard, explicit overrides, diagnostic detail, and non-Linux compilation isolation.
• Linux UI/style and options-selector behavior.

Validation

On head 559d323f35e17b674cf86def9e5629547f3b35c8:

• Community CI #284 (33026716443): Ubuntu ✅, Windows ✅, macOS ARM ✅, macOS Intel ✅.
• Community Provenance #116 (33026716464): ✅.
• Secure Updater Policy build(deps): bump zip from 4.6.1 to 8.6.0 in /src-tauri #16 (33026716450): ✅.

The matrix includes native and Tauri Rust formatting, Clippy with -D warnings, Rust tests/builds, npm test, typecheck, security audit, G3MTool/UndertaleModTool manifest verification, applicable Electron/CSX smoke tests, and package smoke builds.

Remaining release gate

CI cannot prove the original host-runtime symptoms. Before release, validate on a real Arch/Omarchy/Hyprland host:

• theme audio actually plays (paused === false, readyState >= 2, advancing currentTime, PipeWire stream visible);
• no DELTAMOD_MEDIA_SOURCE_CHANGED errors;
• WebKit CPU/RSS and frame pacing in Auto/Performance/Quality;
• no stray NVIDIA userspace libraries in the WebKit process when Mesa pinning is selected;
• no new WebKitWebProcess coredumps;
• Quality-mode H.264/AAC behavior;
• workspace 3 behavior.

No manual WEBKIT_DISABLE_DMABUF_RENDERER workaround is required by the application policy.