fix(windows): give blocks a media path without the verbatim prefix

[srperens]

Closes #835

Problem

On Windows no Recorder flow writes a file. block_expansion canonicalizes media_path for every block, and on Windows canonicalize() returns a verbatim path (\\?\C:\...). The Recorder joins its file name onto that with /. Inside a verbatim path / is not a separator, so filesink refuses the location, splitmuxsink stays in READY, and the flow never reaches EOS. Root cause found by @wagenet in #835; from his diagnostic run on the Windows runner:

GstFileSink:sink: Could not open file "\\?\C:\Users\runneradmin\AppData\Local\Temp\.tmp52YXSk\recordings/diag_20261005_155721_00000.mp4" for writing.
gstfilesink.c(509): gst_file_sink_open_file (): system error: Invalid argument

Every flow goes through block_expansion, so this hits a real Windows server, not only the test.

Change

• block_expansion canonicalizes with dunce::canonicalize instead of Path::canonicalize. dunce returns the plain C:\... form whenever that form is valid, and keeps the verbatim form only where it is needed. On Linux and macOS it is std::fs::canonicalize, so nothing changes there. dunce was already in Cargo.lock as a transitive dependency.
• recorder_records_when_driven_through_pipeline_start is no longer ignored on Windows.

Rejected:

• Building the Recorder's location with Path::join instead of /. That fixes one block; every block that joins onto _media_path with / would still break. The Live Recorder in feat(live recorder): a recorder where a quiet track holds nothing up #1034 builds its location the same way (format!("{}/{}_{}_%05d.{}", ...)) and would hit this too.
• std::path::absolute instead of canonicalizing. It drops symlink resolution, which other code may rely on.

Evidence

• The test fails on Windows without the fix. Commit 1 (86921c9) only removes the ignore; Build (Windows) in run 37754917806:

  test unfed_track::recorder_records_when_driven_through_pipeline_start ... FAILED
  pipeline reached EOS within 30s — a splitmuxsink pad for a connected track was not requested in time: Elapsed(())
  

• The test passes on Windows with the fix. Commit 2 (5fb89ae), Build (Windows) in run 37757051131:

  test unfed_track::recorder_records_when_driven_through_pipeline_start ... ok
  

Tests

• Ran: pre-commit hook (cargo fmt --check, cargo clippy --workspace --all-targets --features efp,nvidia -D warnings), macOS.
• Windows CI (ci:windows) on both commits: see Evidence. Build (Windows) is still red on commit 2 for one unrelated test, media_download_test::partial_download_never_appears_under_the_final_name ("the first half never reached the disk"). It fails the same way on main (run 37751779361, after feat(media): download a file from a URL, and stream uploads with progress #1043), so it is not caused by this PR.
• port_pool_test::a_port_held_by_another_process_is_skipped_and_marked_blocked failed on commit 1 and passed on commit 2; it also failed on main in run 37751779361. Unrelated to this change.

For the reviewer

• Every block now gets _media_path without the \\?\ prefix on Windows. The Media Player canonicalizes its own paths again (mediaplayer/mod.rs) and is not affected by this change.

Out of scope

• feat(live recorder): a recorder where a quiet track holds nothing up #1034 (Live Recorder) tests drive the block without PipelineManager, so they never see a canonicalized path. A test through PipelineManager belongs in that PR.

🤖 Generated with Claude Code