Harden Graphify handoff and expand host tooling

[abmmhasan]

Scope

This branch completes three LocalDevStack improvements:

1. round-trip-safe Graphify/docstruct publication;
2. unified host conversion under lds convert <docs|image|audio|video>;
3. a supported, discoverable lds tools utility runner.

Unified conversion UX

lds convert docs  <input> <output> [pandoc-options...]
lds convert image <input> <output> [imagemagick-options...]
lds convert audio <input> <output> [ffmpeg-output-options...]
lds convert video <input> <output> [ffmpeg-output-options...]

Examples:

lds convert docs README.md README.html
lds convert image photo.png photo.webp -- -quality 82 -strip
lds convert audio recording.wav recording.mp3
lds convert audio recording.wav recording.ogg -- -c:a libopus -b:a 128k
lds convert video recording.mov recording.mp4
lds convert video recording.mkv recording.webm -- -c:v libvpx-vp9 -crf 32 -b:v 0

Capability discovery:

lds convert docs --list-input-formats
lds convert image --formats
lds convert audio --formats
lds convert audio --codecs
lds convert audio --encoders
lds convert video --version

Documents use Pandoc, images use ImageMagick, and audio/video use FFmpeg.

The first-class media converter intentionally owns one input, overwrite policy, and one output. It reserves FFmpeg -i, -y, and -n. For multi-input, concat, capture, or advanced filtergraph workflows use the raw Tools surface:

lds tools ffmpeg ...

Media utilities in lds tools

The curated catalog now includes:

• ffmpeg
• ffprobe
• sox
• soxi
• mkvmerge
• mkvinfo
• mkvextract
• mkvpropedit
• mediainfo

xvidcore is documented as codec runtime support rather than a standalone tool.

Examples:

lds tools ffprobe media.mkv
lds tools mediainfo media.mkv
lds tools soxi recording.wav
lds tools mkvinfo media.mkv

The existing generic Tools runner remains future-proof: any non-reserved command present in the Tools image can run through lds tools <name>.

Conversion / runner safety

• temporary conversion containers use --network none;
• input mount is read-only;
• output publication is controlled;
• host UID/GID is preserved;
• output/symlink overwrite protections remain enforced;
• Windows/Git Bash/MSYS paths remain supported;
• exact argv is preserved;
• the general Tools runner preserves piped stdin and active LDS AI/Git environment.

The general lds tools runner remains a privileged trusted workstation context because it inherits server-tools volumes including the Docker socket. It is not a sandbox.

Graphify/docstruct

The existing staged Graphify canonicalization remains unchanged and green on minimum/latest Graphify.

Runtime dependency

docker-tools PR #130 supplies FFmpeg, SoX, MKVToolNix, MediaInfo and xvidcore. Its PR run #404 is green on amd64 and arm64.

Validation

Final LocalDevStack head: ea73aca897e5d9d310c3a29d6328720612afb393

PR run #1228: green.

Validated:

• static/ShellCheck;
• CLI/help contracts;
• execution/container contracts;
• docs/image/audio/video conversion contracts;
• media Tools catalog;
• wrapper/stdin/runtime environment contracts;
• Windows bridge;
• documentation contract/build;
• Compose;
• published image baseline;
• Common LLM;
• Graphify minimum/latest compatibility.

Branch is 0 commits behind main.

No merge performed.