Fix exact presentation media timing

[abrichr]

What changed

• encode new exact presentation derivatives as browser-compatible MP4/H.264
• disable B-frames and preserve demuxer presentation timestamps at a 1,000,000-unit track timebase
• bind the overlay timeline duration to the final encoded sample end (max(PTS + duration)), not the final sample start
• preserve validation compatibility for the already-published WebM evidence packs
• add compact media characterization for exact PTS, no DTS reordering, track timebase, and terminal duration

Why

The former VFR WebM path retained decoded frame PTS beyond the container's declared stream duration. Browsers could therefore stop before the terminal VERIFIED/HALTED hold even though the frame inventory existed. A frame timestamp marks a sample start, so using the final PTS as the duration was also one sample short.

Impact

New public presentation packs carry byte-bound MP4 media whose decoded PTS inventory and full duration agree with the overlay timeline and browser parser. No runtime execution or evidence semantics change.

Validation

• focused timing and retained-pack tests: 5 passed
• complete governed reference export: 18 real runs, 3 VERIFIED / 15 HALTED, 344 inventoried files
• standalone pack revalidation passed
• generated demonstration/verified/halted MP4s: has_b_frames=0, time_base=1/1000000
• Ruff lint and format checks passed
• focused MIT wheel/sdist exclusion tests passed
• built wheel and sdist passed the distribution license-boundary validator; no openIMIS/AGPL payload shipped

[abrichr]

Superseded by #257 at exact head 5cded0b. #257 contains this exact H.264 timing change plus the guarded openIMIS Standard replay, targets main directly, and its complete protected matrix passed (including the 28-minute unit lane and 20-minute browser E2E).