ci/cd: use BtbN's prebuilt FFmpeg on Windows

A cold vcpkg FFmpeg build costs ~40 minutes per Windows run and the
Windows dependency chain is the hardest to keep healthy; BtbN's builds
come from public GitHub Actions on the release/8.1 branch (BtbN is an
FFmpeg developer; ffmpeg.org links these builds as the official Windows
option). The archive ships include/, MSVC import libs (.lib), pkg-config
files and the runtime DLLs, and is fetched straight from his release
page with the checksums.sha256 published in the same release — nothing
is mirrored here, so provenance stays upstream.

The Windows jobs download/verify/extract it to .cache/ffmpeg (the
checksum comes from that release's own checksums.sha256), point
FFMPEG_DIR/PKG_CONFIG_PATH at it (pkgconf still comes from vcpkg) and
the installer bundles its DLLs. The manifest gates ffmpeg to !windows
and drops librsvg (the icon now ships as the committed PNG).

.github/workflows/cd.yml

@@ -240,6 +240,37 @@ jobs:
           # icon) and is bundled into the .app by the dylib script.
           brew install cmake pkg-config nasm librsvg autoconf automake libtool autoconf-archive
 
+      # Windows uses BtbN's prebuilt FFmpeg (GPL, shared): the archive
+      # ships include/, MSVC import libs (.lib), pkg-config files and the
+      # runtime DLLs, built from FFmpeg's release/8.1 branch by BtbN's
+      # public GitHub Actions (BtbN is an FFmpeg developer and ffmpeg.org
+      # links these builds). Downloaded from his release page and
+      # verified against the checksums.sha256 published in the same
+      # release; nothing is mirrored here, so provenance stays upstream.
+      # The alternative — a cold vcpkg FFmpeg build — costs ~40 minutes
+      # per run on this platform.
+      - name: Install prebuilt FFmpeg (Windows)
+        if: matrix.platform == 'windows'
+        shell: pwsh
+        run: |
+          $base = "https://github.com/BtbN/FFmpeg-Builds/releases/download/latest"
+          $asset = "ffmpeg-n8.1-latest-win64-gpl-shared-8.1.zip"
+          $dir = Join-Path $env:RUNNER_TEMP "ffmpeg-prebuilt"
+          New-Item -ItemType Directory -Force $dir | Out-Null
+          Invoke-WebRequest -Uri "$base/checksums.sha256" -OutFile "$dir\checksums.sha256"
+          $line = Select-String -Path "$dir\checksums.sha256" -Pattern ([regex]::Escape($asset) + "\s*$") |
+            Select-Object -First 1
+          if (-not $line) { throw "no checksum for $asset in the release's checksums.sha256" }
+          $expected = $line.Line.Split()[0].ToLowerInvariant()
+          Invoke-WebRequest -Uri "$base/$asset" -OutFile "$dir\$asset"
+          $actual = (Get-FileHash "$dir\$asset" -Algorithm SHA256).Hash.ToLowerInvariant()
+          if ($actual -ne $expected) { throw "FFmpeg checksum mismatch: expected $expected, got $actual" }
+          $root = "$env:GITHUB_WORKSPACE\.cache"
+          Remove-Item "$root\ffmpeg", "$root\ffmpeg-extract" -Recurse -Force -ErrorAction SilentlyContinue
+          Expand-Archive -Path "$dir\$asset" -DestinationPath "$root\ffmpeg-extract" -Force
+          $inner = Get-ChildItem "$root\ffmpeg-extract" -Directory | Select-Object -First 1
+          Move-Item $inner.FullName "$root\ffmpeg"
+
       # ------------------------------------------------------------------
       # vcpkg (manifest mode) — built from scratch, no caches
       # ------------------------------------------------------------------
@@ -337,9 +368,14 @@ jobs:
         if: matrix.platform == 'windows'
         shell: pwsh
         run: |
+          # FFmpeg comes from the prebuilt archive extracted above (the
+          # manifest no longer installs it on Windows); vcpkg only
+          # provides pkgconf for oak-ffmpeg-link's build script.
           $prefix = "$env:GITHUB_WORKSPACE\vcpkg_installed\${{ matrix.triplet }}"
-          "FFMPEG_DIR=$prefix" >> $env:GITHUB_ENV
-          "PKG_CONFIG_PATH=$prefix\lib\pkgconfig" >> $env:GITHUB_ENV
+          $ffmpeg = "$env:GITHUB_WORKSPACE\.cache\ffmpeg"
+          "FFMPEG_DIR=$ffmpeg" >> $env:GITHUB_ENV
+          "PKG_CONFIG_PATH=$ffmpeg\lib\pkgconfig" >> $env:GITHUB_ENV
+          "$ffmpeg\bin" >> $env:GITHUB_PATH
           "$prefix\tools\pkgconf" >> $env:GITHUB_PATH
           # Bundled OCIO: ocio-sys' vendored sources build with the MSVC
           # toolchain (what they need — the MSYS2 package was the
@@ -431,8 +467,8 @@ jobs:
         shell: pwsh
         run: |
           New-Item -ItemType Directory -Force target/pkg/win-dlls | Out-Null
-          # vcpkg's dynamic libs (FFmpeg + codecs).
-          Copy-Item "vcpkg_installed\${{ matrix.triplet }}\bin\*.dll" target/pkg/win-dlls/
+          # FFmpeg + codec DLLs from the prebuilt archive (see above).
+          Copy-Item "$env:GITHUB_WORKSPACE\.cache\ffmpeg\bin\*.dll" target/pkg/win-dlls/
           # The MSVC runtime: the build keeps the default dynamic CRT (see
           # the Build step), so ship the redistributable DLLs app-locally.
           $crt = Get-ChildItem "$env:ProgramFiles\Microsoft Visual Studio\*\*\VC\Redist\MSVC\*\x64\Microsoft.VC*.CRT" -Directory -ErrorAction SilentlyContinue |