fix: complete stream reliability and playback hardening

[im-pingo]

Summary

• harden generation-aware media readers, GOP/ring bounds, lifecycle admission, shutdown, and protocol-local overwrite recovery
• make WHEP startup diagnostics and Console live playback reliable, including H.264 browser coverage and WHIP realtime pacing
• complete SIP/GB28181 local protocol labs, cross-protocol playback metadata, recording/DVR readiness, and multi-source config management
• synchronize schema, OpenAPI, recipes, AI-facing docs, risk records, and implementation plan

Verification

• go test -count=1 ./...
• CGO_ENABLED=1 go build -tags audiocodec ./cmd/liveforge
• CGO_ENABLED=1 go test -tags audiocodec -race -coverprofile=coverage.out -covermode=atomic ./...
• go test -race focused core/protocol packages
• LIVEFORGE_PROTOCOL_MATRIX_SOAK=60s go test -tags audiocodec -race ./test/integration -run ^TestSIPGB28181WHIPBrowserBridgeMatrix$ -count=1 -timeout=8m -v
• tools/check-agent-docs_test.sh
• CHECK_AGENT_DOCS_DIFF=1 tools/check-agent-docs.sh
• git diff --check, jq empty agent-manifest.json, schema parity, and no runtime audioCache symbols

Boundary

WebRTC Simulcast layer selection remains explicitly deferred and unsupported. Long-duration beyond the 60-second matrix, high-concurrency, and deployment-capacity testing remain operational follow-up work.