refactor: converge extension ownership and runtime boundaries

.actrc

@@ -0,0 +1,4 @@
+--container-architecture=linux/amd64
+-P ubuntu-22.04=ghcr.io/catthehacker/ubuntu:act-22.04
+--pull=false
+--container-options=--init

.dockerignore

@@ -0,0 +1,12 @@
+**
+!go.mod
+!go.sum
+!cmd/
+!cmd/runner/
+!cmd/runner/**
+!core/
+!core/**
+!pkg/
+!pkg/**
+!skills/
+!skills/**

.gitattributes

@@ -1 +1,5 @@
 *.sh text eol=lf
+*.go text eol=lf
+*.golden text eol=lf
+go.mod text eol=lf
+go.sum text eol=lf

.github/dependabot.yml

@@ -7,19 +7,16 @@ updates:
       day: monday
       time: "04:00"
       timezone: Asia/Shanghai
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 3
     labels:
       - dependencies
       - go
     commit-message:
       prefix: deps
     groups:
-      golang-x:
+      all-go-dependencies:
         patterns:
-          - "golang.org/x/*"
-      chainreactors:
-        patterns:
-          - "github.com/chainreactors/*"
+          - "*"
 
   - package-ecosystem: github-actions
     directory: "/"
@@ -28,8 +25,13 @@ updates:
       day: monday
       time: "04:30"
       timezone: Asia/Shanghai
+    open-pull-requests-limit: 1
     labels:
       - dependencies
       - github-actions
     commit-message:
       prefix: deps
+    groups:
+      all-github-actions:
+        patterns:
+          - "*"

.github/native/README.md

@@ -0,0 +1,46 @@
+# Recorder native SDK
+
+AIScan keeps the native recorder SDK separate from normal product builds.
+
+1. Maintainers run the `recorder-native-sdk` workflow after changing `versions.env` or the native build configuration. It builds the pinned sources, creates relocatable static SDK archives, writes SHA-256 sidecars, and publishes the assets to the versioned GitHub release.
+2. SDK and record-tool developers run `make record` when they need the optional backend. It downloads the matching platform archive once, verifies it, installs it below `.cache/record-native`, and builds `aiscan-record`. Default `make full` and product release jobs do not fetch or link this SDK.
+
+Supported bundles are `linux-amd64`, `linux-arm64`, and `windows-amd64`. FFmpeg and x264 are static, so the distributed executable does not require separate FFmpeg/x264 installation. Operating-system libraries remain external dependencies: Linux uses glibc and X11/XCB; Windows uses system DLLs. The source builder uses an explicit component allowlist (capture input, H.264 encoder, MP4 muxer, and file output only), and packaging rejects static-library sets larger than 16 MiB by default.
+
+The Makefile is the public build interface:
+
+```bash
+make record                            # fetch SDK and build aiscan-record
+make record-native                     # fetch and verify SDK only
+make record-native-source              # build SDK from pinned sources
+make record-native-source record-native-package
+make record-native-source RECORD_ARCH=arm64
+```
+
+Maintainers and CI use the single underlying script when they need an individual stage:
+
+```bash
+bash .github/native/sdk.sh fetch linux amd64
+bash .github/native/sdk.sh build linux amd64
+bash .github/native/sdk.sh package linux amd64 dist/native
+bash .github/native/sdk.sh env linux amd64
+```
+
+Environment overrides:
+
+- `AISCAN_RECORD_PREFIX`: SDK install/cache directory.
+- `AISCAN_RECORD_NATIVE_URL`: release or mirror base URL containing the archive and `.sha256` sidecar.
+- `AISCAN_RECORD_OFFLINE=1`: forbid downloads and require an already cached matching SDK.
+- `AISCAN_RECORD_BUILD_FROM_SOURCE=1`: make `make record` or `make record-native` use the pinned source builder instead of downloading an SDK.
+- `RECORD_ARCH`: target architecture for Makefile SDK targets (defaults to `go env GOARCH`).
+- `RECORD_NATIVE_OUTPUT`: package output directory (defaults to `dist/native`).
+
+When native inputs or flags change, increment `RECORD_NATIVE_VERSION` and `RECORD_NATIVE_RELEASE` together before publishing. Do not replace an existing SDK version with incompatible contents.
+
+## macOS CGO cross-build
+
+The release workflow builds both standard and full macOS binaries on an Ubuntu runner. Standard uses the normal pure-Go `CGO_ENABLED=0` cross-build. Full uses the Zig C/C++ driver with a pinned macOS SDK, `CGO_ENABLED=1`, and external Go linking so the bundled Darwin `libcstx` and RE2 archives can link against `Security`, `CoreFoundation`, `libresolv`, and libc++.
+
+The SDK version, checksum, Zig version, and minimum deployment target are pinned in `versions.env`. The SDK archive is downloaded from the versioned `joseluisq/macosx-sdks` release and verified before extraction. Native recording remains supported only by the Linux and Windows recorder SDK bundles above.
+
+No macOS GitHub Actions runner is used. Linux can validate the generated Mach-O format and architecture, but it cannot execute the release binary; runtime smoke coverage remains the responsibility of downstream macOS users or a separately authorized external test environment.

.github/native/pkg-config-static.cmd

@@ -0,0 +1,15 @@
+@echo off
+setlocal
+set "MINGW_PKG_CONFIG="
+for /f "delims=" %%I in ('where gcc.exe 2^>nul') do (
+  set "MINGW_PKG_CONFIG=%%~dpIpkg-config.exe"
+  goto found
+)
+:found
+if not defined MINGW_PKG_CONFIG goto fallback
+if not exist "%MINGW_PKG_CONFIG%" goto fallback
+"%MINGW_PKG_CONFIG%" --static %*
+exit /b %ERRORLEVEL%
+
+:fallback
+pkg-config --static %*

.github/native/pkg-config-static.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -euo pipefail
+exec pkg-config --static "$@"