music stream: --respect-sections-durations and --sign-with-c2pa may be silently dropped

[longevityboris]

Context

Flagged by Codex audit (docs/reference/spec-audit-pre-v0.3.0.md §2 under music).

music stream inherits flags from the shared music compose builder, but the OpenAPI schema for stream_compose does NOT include respect_sections_durations or sign_with_c2pa — only generate (non-streaming) + compose_detailed expose them.

What to do

1. Verify via live probe: send music stream "..." --sign-with-c2pa and check whether the returned bytes actually carry C2PA metadata (ffmpeg/exiftool).
2. If silent-dropped: either gate these flags off on the stream path (exit 3 with a helpful suggestion directing to music compose), or route to the non-stream endpoint when they're set.
3. Add a code comment pointing at the spec path for future reviewers.

Files

• src/commands/music/stream.rs
• src/commands/music/mod.rs (shared builder)
• src/cli.rs (MusicAction::Stream flags)

Acceptance

• Flags either take effect or are rejected client-side — no silent drops.
• Integration test + spec citation in source comment.