docs: Fold media stack (ffmpeg-ops/ytdlp-ops) into v3.0.0 notes

The media stack landed between the v3.0 commits and ships in the same
tag, but was filed under CHANGELOG [Unreleased]. Move it into [3.0.0]
(as 'media stack' subsections) and add a Recent Updates bullet so the
release notes match what the tag actually contains. [Unreleased] cleared.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,7 +7,11 @@ feature releases live in the README "Recent Updates" section.
 
 ## [Unreleased]
 
-### Added
+_Nothing yet._
+
+## [3.0.0] - 2026-06-10
+
+### Added (media stack)
 - **`ytdlp-ops` skill** - yt-dlp as the media ACQUISITION layer feeding
   ffmpeg-ops: format selection doctrine (`-S` sort over `-f` filters, codec
   targeting that avoids post-download transcodes), `--download-sections`
@@ -61,7 +65,7 @@ feature releases live in the README "Recent Updates" section.
   maps). 19 references, 3 assets, 107-assertion self-test with
   lavfi-synthesized fixtures (no binary fixtures in repo).
 
-### Fixed
+### Fixed (media stack)
 - **`ffmpeg-ops/cut-from-edl.py`** (found by real-media E2E):
   the output directory was created *after* ffmpeg opened the temp output, so
   any `-o` into a not-yet-existing directory died with a cryptic
@@ -71,7 +75,6 @@ feature releases live in the README "Recent Updates" section.
   own `output` field stays EDL-relative per the schema), and the destination
   dir is created before the concat runs.
 
-## [3.0.0] - 2026-06-10
 
 ### Added (skill resource protocol)
 - **`docs/SKILL-RESOURCE-PROTOCOL.md`** - the build standard for skill `scripts/`,

README.md

@@ -26,6 +26,7 @@ From Python async patterns to Rust ownership models, from AWS Fargate deployment
 - **Skills-first restructure** - *Breaking:* the expert-agent layer was cut from 23 to 3. Per Anthropic's guidance, knowledge belongs in skills (progressive disclosure, single source of truth) and subagents are reserved for context isolation — so *all* domain-knowledge agents became `-ops` skills (the 11 language/framework experts → their twins; cypress/cloudflare/bash/craftcms/payloadcms/asus-router → new skills; claude-architect/aws-fargate folded into existing skills). The 3 remaining agents are pure isolation/worker roles: `git-agent` (background commits/PRs), `firecrawl-expert` (noisy multi-page scrapes), `project-organizer` (bulk restructure). Dispatching skills now route `general-purpose` agents that preload skill references.
 - **`claude-code-ops` skill** - claude-code-debug/-headless/-hooks merged and rebuilt from current official docs: the 30-event hook catalog with per-event JSON contracts, today's SKILL.md frontmatter spec, headless/CLI reference, and extension-debugging decision trees.
 - **Three new skills, doc-verified** - `claude-api-ops` (Messages API, tool use, prompt caching, structured outputs, Agent SDK), `playwright-ops` (selector hierarchy, fixtures, CI sharding, flake hunting), `terraform-ops` (state, modules, OIDC plan/apply, secrets).
+- **Media stack** - `ffmpeg-ops` (probe-first ffmpeg/ffprobe: ~30-command cookbook, EDL-driven editing, `.cube` LUT grading, VMAF gates, loudnorm, Whisper prep) and `ytdlp-ops` (the yt-dlp acquisition layer feeding it: format doctrine, clip-at-download, incremental channel syncs), each shipping a §7 staleness verifier.
 - **Live security guards, zero hand-wiring** - `config-change-guard.sh` scans Claude settings files for worm-persistence IOCs the moment they're edited; `worktree-guard.sh` mechanically enforces worktree boundaries. Plugin-level `hooks/hooks.json` auto-wires the security set on install.
 - **Skill Resource Protocol** - one build standard for skill scripts and assets ([docs/SKILL-RESOURCE-PROTOCOL.md](docs/SKILL-RESOURCE-PROTOCOL.md)), headlined by the staleness-verifier pattern: offline checks gate PR CI, live drift checks run weekly without ever blocking a PR. Four verifiers ship with it.
 - **fleet-ops v2** - repositioned as landing discipline (sequential queue, test-gated merge, pre-land scrub, one-shot revert, new `fleet track`) on top of native agent teams and background agents, which now own session spawning.