Sync upstream GStreamer into ignis-main

[github-actions]

This PR merges the latest upstream GStreamer main branch into ignis-main while preserving Ignis changes.

---

Note

Medium Risk
Large upstream merge touching codec parsers, CI, and fuzz build configuration increases regression surface; no direct auth changes, but demuxer/parser and tracing API shifts may affect downstream Ignis builds or tests.

Overview
This merge pulls the latest upstream GStreamer main into ignis-main; the diff is upstream work, not new Ignis-only features.

CI and validation — GitLab CI now skips Windows/macOS/Cerbero-style jobs for the gstreamer-security project, tightens abi-check Meson options (tests/examples disabled), bumps ABI_CHECK_TAG, and refactors valgrind job path rules via shared *toplevel_and_ci_changes / *modules_changes anchors. ci/scripts/test.sh omits --check-bugs when CI_PROJECT_NAME is gstreamer-security.

Fuzzing — OSS-Fuzz build enables gst-plugins-good and gst-plugins-bad with a narrow set of demux/parser plugins instead of disabling them entirely. New libFuzzer targets exercise audio (caps, converter/resampler/quantize), gst-value (caps/structure deserialization), and video (metadata parsers and video-converter), with seeds/corpus updates for discoverer and value fuzzing.

API / introspection (GIR) — Documents 1.30 tracing spans (GST_DEFINE_TRACE_FORMAT, gst_trace_span_*, deprecated GstTracerRecord), plugin static registry flags and gst_plugin_get_registry(), RISC-V Vector CPU probe, BaseParse duplicate-PTS and BaseSink enable-last-sample-notify, AHardwareBuffer / IOSurface memory helpers, richer H.265 levels and H.274 digitally signed content SEI types, and segmentation mask docs in analytics.

Misc — AGENTS.md drops the robot-emoji acknowledgment rule; Fluster MV-HEVC reference hashes updated; GES micro version bump in GIR.

^{Reviewed by Cursor Bugbot for commit d1bd95b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Validate synthesis omits first details

Medium Severity

In _do_report_synthesis, the first report in each issue group still gets level and “Detected on”, but gst_validate_report_print_details no longer runs for that entry. Critical and full-detail issues that only appear once (or sit at the list head) lose their Details block in synthesized output.

 

^{Reviewed by Cursor Bugbot for commit 048051e. Configure here.}

[cursor]

Dot-dir uses wrong timestamp

Low Severity

The new dot-dir branch builds dot filenames from raw gst_util_get_timestamp(), while the default path uses GST_DEBUG_BIN_TO_DOT_FILE_WITH_TS, which stamps elapsed time since GStreamer start. Mixed runs produce incomparable or misleading dot names for the same scenario action.

 

^{Reviewed by Cursor Bugbot for commit 048051e. Configure here.}

[cursor]

Cerbero security skip rule order

Medium Severity

The new gstreamer-security when: never rule on cerbero trigger sits after - if: '$MESON_COMMIT'. GitLab applies the first matching rule, so a non-empty MESON_COMMIT still starts Cerbero on gstreamer-security, unlike Windows/macOS jobs that check the project name first.

 

^{Reviewed by Cursor Bugbot for commit a53b91e. Configure here.}