Add audio and region recording; make routine CI manual (#25)

The top-bar recorder previously saved a full monitor without sound. It now lets you select a region within one monitor and choose system audio, microphone audio, or both. Audio remains off by default, and recordings with audio are saved as VP8/Opus WebM files. The portal still controls screen access and cancellation; stopping from the bar or ending the video stream finishes the recording, including its audio tracks.

Region selection accounts for fractional display scales and negative monitor coordinates. The picker keeps its action buttons visible while the display list and recording options scroll together. The picker, dependency lists, and recording documentation now explain the available choices and the slurp and audio requirements.

Routine pushes and pull requests no longer start CI runners. Workspace checks and website deployment are manual, while release checks run when requested manually, through a version tag, or through a PR labeled `release`. Publishing still requires a pushed version tag. This also fixes release asset checksums by normalizing RPM filenames before generating the checksum file.

Validated locally with a release build, portal and shell recorder tests, formatting, Clippy, actionlint, packaging tests, and mocked publishing checks. Media tests encoded and decoded cropped video with audio, checked that video termination finishes live audio, and exercised system, microphone, and combined capture against a private PipeWire-Pulse server. Mixed recordings must contain both fixture frequencies, with negative controls for either missing source. The picker was also checked on 800 × 600 and 800 × 400 desktops and opened in a live nested window.

.github/workflows/pages.yml

@@ -1,13 +1,5 @@
 name: Deploy website to GitHub Pages
 on:
-  push:
-    branches: [main]
-    paths:
-      - "site/**"
-      - "docs/**"
-      - "assets/branding/**"
-      - "scripts/build-site.py"
-      - ".github/workflows/pages.yml"
   workflow_dispatch:
 permissions:
   contents: read

.github/workflows/release-checks.yml

@@ -1,8 +1,5 @@
 name: Workspace release checks
 on:
-  pull_request:
-  push:
-    branches: [main]
   workflow_dispatch:
   workflow_call:
 permissions:
@@ -68,6 +65,11 @@ jobs:
           cargo test --locked -p ferese state::capture_privacy::tests -- --ignored
           cargo test --locked -p ferese backends::direct::capture::tests::capture_recomposes_cursor_without_touching_the_display_target -- --ignored
           cargo test --locked -p ferese winit::tests::capture_failure_restores_display_target_and_subsequent_frames_render -- --ignored
+      - name: Test recorder audio, cropping and stream revocation
+        run: |
+          cargo test --locked -p xdg-desktop-portal-ferese --bin ferese-record encoder_finishes_a_real_webm -- --ignored
+          cargo test --locked -p xdg-desktop-portal-ferese --bin ferese-record encoder_saves_cropped_video_and_mixed_audio_when_stopped -- --ignored
+          cargo test --locked -p xdg-desktop-portal-ferese --bin ferese-record video_eos_finishes_live_audio_without_waiting_for_the_user -- --ignored
       - name: Test native shell, visibility and resize behavior
         run: |
           install -m 0644 packaging/pam.d/ferese-lock.fedora /etc/pam.d/ferese-lock

.github/workflows/release.yml

@@ -166,6 +166,17 @@ jobs:
           RELEASE_TAG: ${{ github.ref_name }}
         run: |
           cd artifacts
+          # GitHub replaces '~' in uploaded filenames. Use those same download
+          # names in SHA256SUMS so verification works after downloading RPMs.
+          python3 - <<'PY'
+          from pathlib import Path
+          for source in Path('.').glob('*.rpm'):
+              destination = source.with_name(source.name.replace('~', '.'))
+              if source != destination:
+                  if destination.exists():
+                      raise SystemExit(f'Duplicate release asset: {destination}')
+                  source.rename(destination)
+          PY
           rm SHA256SUMS
           sha256sum * > SHA256SUMS
           gh release upload "$RELEASE_TAG" ./* --clobber

.github/workflows/workspace-checks.yml

@@ -1,38 +1,5 @@
 name: Workspace and native stability checks
 on:
-  pull_request:
-    paths:
-      - "compositor/**"
-      - "crates/**"
-      - "shell/**"
-      - "portal/**"
-      - "feresectl/**"
-      - "scripts/**"
-      - "packaging/**"
-      - "assets/**"
-      - "LICENSE"
-      - "rust-toolchain.toml"
-      - "rustfmt.toml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - ".github/workflows/workspace-checks.yml"
-  push:
-    branches: [main]
-    paths:
-      - "compositor/**"
-      - "crates/**"
-      - "shell/**"
-      - "portal/**"
-      - "feresectl/**"
-      - "scripts/**"
-      - "packaging/**"
-      - "assets/**"
-      - "LICENSE"
-      - "rust-toolchain.toml"
-      - "rustfmt.toml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - ".github/workflows/workspace-checks.yml"
   workflow_dispatch:
 permissions:
   contents: read