Reject malformed scanner audio before storage

[GmcSDLK]

Retrospective record

This PR records the RDio scanner fix that was approved and deployed during the 2026-08-08 malformed/empty-audio incident. It is intentionally scoped to the RDio-owned scanner path; no MaydayMon web code, scanner configuration, recordings, databases, or credentials are changed by this PR.

Observed failure

ffmpeg detected MPEG-TS input but reported no usable stream, then failed while writing the ipod/m4a-style output pipe. The previous code logged the ffmpeg error but returned success from conversion, so the controller continued to write and emit the call.

Change

• Return a classified conversion error with exit status and input byte count.
• Reject the call before database write and downstream emission when conversion fails.
• Add an opaque ingest ID and source route to diagnostics; no audio or transcript content is logged.
• Preserve successful m4a handling and the approved 64k AAC conversion arguments.
• Add synthetic regression tests for malformed input, error classification, diagnostics redaction, and successful conversion handling.

Validation

• git diff --check passed.
• Tests use synthetic input and a local fake ffmpeg process; no production recordings or credentials are required.
• Go tests were not run on the workstation because Go is not installed locally; the live host has Go 1.22 while this current upstream branch declares Go 1.26.

Deployment status

Already deployed to RDio before this retrospective PR was opened, following approval. No deployment, restart, configuration change, database change, recording change, or MaydayMon web change is being performed as part of opening this PR.