Mirid media source supplement

This supplement retains the official PyAV 19.0.1 source distribution, the sources
selected by upstream PyAV-FFmpeg's Windows x86_64 build recipe, and the exact
recipe/patch files at commit bac889417e26be29615cb6a3f38318151fed55cd
(release tag 9.0.2-1). Source archives are unmodified and checked against upstream
SHA-256 pins. Recipe files are checked against upstream Git blob hashes. No
upstream source was executed while collecting this supplement.

The runtime candidate selects the official file
av-19.0.1-cp312-abi3-win_amd64.whl
SHA-256 906fc3db09288319a75ea23ffefb59961c7dbe0d1c074601507a89de7d8593d8.
Its exact upstream wheel metadata and selection evidence are in evidence/.
The tagged PyAV build selects the FFmpeg 9.0.2-1 vendor release. Its Windows
vendor archive is identified in evidence/ffmpeg-release.json; vendor binaries
are not duplicated in this source supplement.

Copyright and license terms remain those in each original source archive.
source-inputs.json indexes license/notice member paths and their exact hashes.
The BSD-3-Clause statement in PyAV metadata covers PyAV itself. It does not
replace the separate terms of FFmpeg or its bundled dependencies. The retained
recipe enables version3, x264 and x265; preserve all corresponding notices and
source material when distributing the native libraries.

Scope: this is a media-source supplement, not the whole Mirid source release.
It includes the selected upstream codec and hardware-header sources. It does
not reconstruct every MSYS2-supplied toolchain/system library. The final
installed/frozen DLL inventory and runtime test report remain authoritative for
what Mirid actually contains and exercises. No claim of general security or
complete whole-product corresponding-source compliance is made here.

The libpng source transfer used the MacPorts source mirror after repeated
SourceForge truncation. Its bytes match the exact SHA-256 in the upstream
FFmpeg recipe; evidence/png-alternate-origins.json records this transfer.
