[FedyaLight]

Stacked on the #16 branch (fix/damaged-audio-packets), whose portable
engine sends MXF straight to FFmpeg without Symphonia's probe.

AVFoundation cannot open MXF. On macOS, Canon XF-AVC, Sony XAVC and other
MXF clips were reported as "Decode error: invalid PCM." and left out of
synchronization; macOS releases shipped no FFmpeg.

Changes:

• The macOS engine hands MXF, and only MXF, to the FFmpeg tier for
  inspection, analysis, refinement windows and native (export) decoding.
  It reads them exactly as the portable engine does on Linux and Windows.
  Every other format stays with AVFoundation.
• A missing FFmpeg ends the run only where Align ships it (Windows, Linux).
  On macOS, where development builds may lack it, MXF files are then left
  out with a warning, as in 0.3.2, instead of stopping synchronization.
• macOS releases build the same minimal LGPL FFmpeg as Linux and Windows
  (build-ffmpeg-minimal.sh, now with MACOSX_DEPLOYMENT_TARGET=15.0, the
  app's LSMinimumSystemVersion) and bundle ffmpeg and ffprobe in
  Align.app/Contents/MacOS, where both entry points already look for
  sidecars, with FFMPEG-LICENSE.txt and the corresponding FFmpeg source in
  align-source-macOS.tar.gz. About 7 MB.
• package-macos.sh (with BUNDLE_FFMPEG=1, as the release job now sets)
  rejects tools that are not arm64 built for macOS 15.0 (lipo, vtool)
  or that link libraries outside /usr/lib and /System/Library. The
  bundle is signed ad hoc with --deep, which covers the tools.
• docs/distribution.md, docs/formats.md and the release notes template
  describe FFmpeg on macOS, including the local packaging command and that
  the build manifest's hashes describe the tools before macOS re-signs them.

Verified locally:

• The minimal FFmpeg built on macOS links only libSystem, CoreFoundation,
  CoreVideo and CoreMedia, and reads camera-original Canon EOS C70 XF-AVC,
  Sony XAVC (4K, 8 tracks) and MPEG-2 MXF completely.
• package-macos.sh with BUNDLE_FFMPEG=1 packaged the app; codesign --verify --deep --strict passes. The CLI inside Align.app, run with
  PATH=/usr/bin:/bin and the default macOS engine, synchronized the Canon
  C70 MXF with its recorder at the correct offset; 0.3.2 left it out with
  "invalid PCM".
• Packaging rejects an FFmpeg built without the deployment target ("built
  for arm64, macOS 27.2; need arm64, macOS 15.0") and accepts the rebuilt
  one (minos 15.0).
• With ffprobe but no ffmpeg, a development CLI on a clean PATH
  synchronizes the rest and warns about the MXF, instead of exiting with
  "ffmpeg missing".
• Tests: mxf_is_read_through_ffmpeg (macOS): the macOS engine inspects an
  MXF exactly like the portable engine and decodes it; with MXF routed to
  AVFoundation it fails with "InvalidPcm".
  missing_ffmpeg_ends_the_run_only_where_it_ships covers the policy.
• cargo fmt, cargo clippy -D warnings, cargo test --workspace: 383
  passed, 1 ignored; script/test-release-source.py; workflow YAML parses.

Not verified here: the release job itself, which runs on a tag. It now
builds FFmpeg on the macOS runner, which already installs nasm.