Enforce M17.9 demo validation in CI

[jmjava]

Summary

• add a path-scoped CI gate for all demo source and committed recording changes
• fetch Git LFS media and run pinned docgen validate --pre-push
• install ffmpeg and Tesseract so stream, A/V drift, narration, and terminal-error OCR checks are authoritative
• promote OCR warnings to hard CI failures while retaining non-contract layout diagnostics as warnings
• retain validation logs for diagnosis and add static acceptance coverage
• record completed M17.8 and M17.9 evidence

Verification

• demo-validation run 34975666059: passed all committed recordings
• local docgen validate --pre-push plus authoritative OCR check: passed
• M17.9 acceptance tests and Ruff: passed
• strict JSON/YAML parsing: passed
• local regression, static quality, and supply-chain CI: passed