[joepetjr]

Summary

RC-3 from the portfolio remediation plan, narrowed. --check-deps and the onnxruntime extra already existed. This adds the missing checks. Stacked on the RC-2 branch; the diff against that branch is 855 lines.

• redact_video() calls require_ffmpeg() first. A missing ffmpeg or ffprobe raises FfmpegUnavailableError with an install hint before detection starts.
• --check-deps exits 1 when ffmpeg or ffprobe is missing. --skip-ffmpeg opts out.
• --check-deps --model KIND=PATH hashes each supplied model file, loads its detector and runs one blank-frame inference.
• --check-deps --receipt FILE runs every check, requires all four model files, never downloads weights, renders a synthetic ffmpeg test clip through the pipeline and writes redactcam.clean-machine-receipt/v1. It exits 0 only when everything passed.

Design decisions made by the author (please review)

• release.yml smoke test becomes redactcam.exe --check-deps --skip-ffmpeg, because the release runner has no ffmpeg and the stricter check would fail the build. tests/test_packaging.py asserts it.
• --receipt and --skip-ffmpeg without --check-deps, and the two together, are parser errors.
• A failed qualification still writes the receipt.

Test plan

• Full suite re-run by the dispatcher through the slot wrapper: 245 passed. ruff check . clean.
• Red first: tests/test_qualify.py failed with ImportError: cannot import name 'qualify'; the ffmpeg gate test failed with AttributeError ... has no attribute 'require_ffmpeg'.

Acceptance

• FFmpeg checked up front and by --check-deps: met.
• Model files proven loadable: met.
• Clean-machine receipt qualified only when all checks and the render pass: met by tests with fakes.

Not in this PR

• The real clean-machine proof on a fresh supported OS with the real four models, and any GPU provider proof. No models were downloaded and no real video was processed.
• Which OS and model files count as supported. The receipt records what ran and does not judge it.
• No version bump.