port: pin by tag, and how to verify audio with no sound card

**The pin.** Pin a TAG, never a bare sha. A sha reachable only from an auto/*
branch is orphaned when that branch is deleted or -- worse -- squash-merged,
because squash creates new commits: main looks like it contains the work while
the pin becomes unreachable and this project stops building for a fresh
checkout, silently, at their build. formats-pin-2026-08-29 exists for the
current state.

Also says plainly why NOT to float to a branch, which was the tempting fix:
Cargo resolves a git dependency once and writes the sha into Cargo.lock, so
floating gives staleness you cannot see instead of staleness you can read.
push-work now pushes --follow-tags so annotated tags travel with the branch.

**Audio.** docs/AUDIO-VERIFICATION.md separates three questions that were being
asked as one: is the transcode faithful (no engine, no device -- a file-vs-file
difference measurement), does Godot route it (AudioEffectRecord on the Master
bus writes a WAV from a headless run), and what does the GAME play (a PulseAudio
null sink, which needs a rebuild).

It leads with the three ways the fidelity measurement lies, because all three
were hit on the first attempt and each produces a confident wrong number rather
than an error: unaligned subtraction, mismatched channel layouts, and probing a
file another process is still writing.

The 5.1 disc fact deliberately is NOT copied here -- it lives in the RE corpus
at docs/re/structures/movie-audio-channels.md and is linked, so there is one
copy to keep true rather than two that drift. Same reason HANDOFF is a summary
with links.

The downmix itself stays flagged as an unmade decision, not quietly resolved.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker/bin/push-work

@@ -16,7 +16,7 @@
 # `sylph-agent`). They are never printed, never logged, and never passed on a
 # command line.
 #
-#   push-work            push the current branch
+#   push-work            push the current branch, and any annotated tags on it
 #   push-work --dry-run  say what it would do
 set -euo pipefail
 
@@ -72,5 +72,5 @@ fi
 # --force-with-lease is deliberately NOT offered. If this is rejected as
 # non-fast-forward, someone else moved the branch: fetch and merge, do not
 # overwrite.
-git -c "credential.helper=$CRED_HELPER" push --set-upstream origin "$branch"
+git -c "credential.helper=$CRED_HELPER" push --follow-tags --set-upstream origin "$branch"
 echo "push-work: pushed $branch"