feat(packaging): bundle ffmpeg in the Windows installer by default

winget install ffmpeg was considered and rejected as the mechanism: it
needs network access and winget/App Installer present at the exact
moment setup runs, and its failure mode is silent -- video just does
not stream, with nothing pointing back at ffmpeg. Not viable for a
non-technical install.

MeshBay transcodes browser-incompatible video to H.264 (-c:v libx264,
webrtc_server.py) -- a real encode, not remux -- so this needs a genuine
GPL ffmpeg build; no LGPL-only build includes an H.264 encoder, since
libx264 itself is GPL.

packaging/win/fetch-ffmpeg.ps1 (new)
  Downloads, checksum-verifies and stages ffmpeg for the build. Source:
  BtbN/FFmpeg-Builds' Windows x86_64 gpl-shared preset -- shared DLLs
  rather than two independent static binaries, which is what nearly
  tripled this: the "full" static build many devs already have via
  winget is ~220 MB *per executable*. Pinned to one dated release tag
  (immutable once published) and its own sha256, not the "latest" alias
  BtbN repoints on every auto-build -- verified by hand first (downloaded,
  hash matched, ran a real encode+probe with libx264) before pinning.
  ffplay.exe (an SDL2 player, ~17 MB) is dropped; MeshBay never invokes
  it. Cached after the first build. Runs its own smoke test (encode +
  probe a real clip) so a broken fetch fails at build time, not for the
  first user who tries to watch something.

packaging/win/LICENSE-ffmpeg.txt (new)
  GPLv3 notice + where the corresponding source is, required because
  this redistributes a GPL binary even though it is unmodified and only
  ever invoked as a subprocess. Ships alongside ffmpeg.exe in the
  installer.

build-node-runtime.ps1 / build-win.ps1
  Bundling is now the DEFAULT, replacing the old opt-in -FfmpegDir (which
  copied from a local directory and left most builds without ffmpeg at
  all). -SkipFfmpeg opts out for a smaller, streaming-less local-iteration
  build.

  Also fixes a real bug the ffmpeg change exposed rather than caused: the
  final `--help` smoke test did `$help -notmatch "meshbay-node"` against
  $help captured as a PowerShell ARRAY (one element per line) -- -notmatch
  on a collection is a FILTER, not a boolean test, and returns the
  non-matching elements; any non-empty array is truthy in if() regardless
  of content. Once --help wrapped past one line (it now does, with
  autostart/service in the verb list) this threw unconditionally. Fixed
  by joining to one string before matching, and pinned by a new test so
  a future edit cannot silently reintroduce the collection-vs-scalar trap.

Verified: downloaded and hashed the pinned release by hand (matches),
ran a real libx264 encode + ffprobe against the extracted build,
fetch-ffmpeg.ps1 end to end (161 MB staged), a full build-node-runtime.ps1
run (308 MB node-runtime/) and a full installer build (MeshBay-Setup-
1.0.0.exe, 210.8 MB with ffmpeg bundled). Node suite 850 pass / 25 skip.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2 files changed, 9 insertions, 6 deletions

diff --git a/docs/PACKAGING-GUIDE.md b/docs/PACKAGING-GUIDE.md
index 4dcda30..9649826 100644
--- a/docs/PACKAGING-GUIDE.md
+++ b/docs/PACKAGING-GUIDE.md
@@ -86,9 +86,9 @@ It asks two things, both skippable:
 Running setup again (an upgrade, a repair install) asks neither question if
 the firewall rules are already there.
 
-**ffmpeg** is required for video streaming and is *not* in the installer unless
-it was built with `-FfmpegDir`. Otherwise install it separately
-(`winget install ffmpeg`) so the node finds it on `PATH`.
+**ffmpeg** — required for video streaming, **bundled in the installer by
+default** (verified, checksummed, GPLv3-licensed; `LICENSE-ffmpeg.txt` ships
+alongside it). Nothing to install separately.
 
 ### First run
 
diff --git a/docs/WINDOWS-PORT.md b/docs/WINDOWS-PORT.md
index ceba2b8..da281c3 100644
--- a/docs/WINDOWS-PORT.md
+++ b/docs/WINDOWS-PORT.md
@@ -333,9 +333,12 @@ what the W3 autostart launcher points at (`platform._node_exe`). The embeddable
 zip needs pip to produce that wrapper, and the wrapper bakes in an **absolute**
 interpreter path that breaks the moment the tree is installed elsewhere.
 
-**ffmpeg** is not bundled by default (the node finds it on `PATH`); pass
-`-FfmpegDir` to `build-win.ps1` to copy `ffmpeg.exe`/`ffprobe.exe` in beside the
-daemon for a self-contained installer.
+**ffmpeg is bundled by default** (`packaging/win/fetch-ffmpeg.ps1` — downloaded
+from a pinned, checksum-verified BtbN/FFmpeg-Builds release, ~161 MB, GPLv3
+because the transcode path needs libx264 and no LGPL-only build has one;
+`LICENSE-ffmpeg.txt` ships with it). `winget install ffmpeg` was considered and
+rejected as the mechanism: it needs network + winget present at install time
+and fails silently. `-SkipFfmpeg` opts out for a smaller local-iteration build.
 
 **Still open:** Authenticode signing (Phase 13.9 — unsigned ⇒ SmartScreen),
 a Windows CI runner (Phase 18.3), `electron-updater`. First clean-machine