feat(record): add native desktop capture tool

[M09Ic]

Summary

• add the optional full-build record tool for Windows and Linux X11
• support desktop/window screenshots plus synchronous and asynchronous H.264/MP4 recording
• return bounded inline screenshot previews and task-relative video media URIs backed by ranged aop.file reads
• add pinned, feature-minimal static FFmpeg/x264 SDK build, package, fetch, and release workflows
• wire recorder capability discovery into full builds and verify static linkage in CI/release jobs

Stack

• Based on feat(scan): emit native artifacts with correlated loot #85 (feat/native-artifact-loot) because it consumes the canonical loot/media and ranged file schemas.
• The cyber-ui protocol source is already merged in feat(aop): correlate loot and support ranged file reads cyber-ui#11 and pinned at 236facf.
• Record changes are intentionally excluded from feat(scan): emit native artifacts with correlated loot #85.

Validation

• go test ./...
• go vet ./...
• go test -race ./tools/record ./pkg/node ./agent
• go test ./... and go vet ./... in aop/
• pinned protobuf 35.1 regeneration with no diff
• frontend production build
• Bash syntax, YAML parse, go mod tidy, and git diff --check
• Windows amd64 native screenshot, window/PID capture, MP4 recording, full-tag tests, race test, and full binary build
• Windows binary import inspection: no libav, x264, or libwinpthread DLL dependency
• Linux amd64 native screenshot/record integration, full binary build, component allowlist, package size guard, and ldd static-link verification

Notes

• Linux capture requires X11; Wayland is rejected explicitly.
• Audio capture is not included.
• PR CI falls back to the same pinned source builders until the versioned native SDK release is published.