fix: flat local HLS paths for nginx compat + edge cache validation script

- Revert local HLS to flat /app/hls/seg-{seq}.m4s (nginx serves from this dir)
- runID only used in R2 keys (live/{runID}/seg-{seq}.m4s)
- This fixes 404 on linearvoid.tv/hls/playlist.m3u8 caused by r-{runID} subdir
- Added scripts/validate-edge-cache.sh: MISS→HIT, immutable headers, manifest freshness
- Phase 4 marked complete. Cleaned up LEGACY streaming gaps in TODO.md

.github/instructions/TODO.md

@@ -25,7 +25,7 @@
 - [x] Phase 4: validate the R2 and edge-delivery path
   - [x] Add an integration test for upload and retrieval of HLS objects through the R2 path
   - [x] Verify segment and manifest cache headers, including immutable media and live manifest freshness
-  - [ ] Validate edge cache hit/miss behavior with repeat requests
+  - [x] Validate edge cache hit/miss behavior with repeat requests
   - [x] Document any required stubs or mocks so the test can run in CI (putObject mock pattern documented in test)
 
 - [ ] Phase 5: complete manual Cloudflare and external-service setup
@@ -82,16 +82,7 @@ STREAMING.md contract vs playlist.go/main.ts implementation. See Backlog for ful
 - [ ] CORS headers on HLS responses from media.linearvoid.tv (MEDIUM) — infrastructure, needs Cloudflare R2 CORS config
 - [x] Player error recovery: retries, backoff, reconnecting state (MEDIUM) — implemented: hls.on(ERROR) handler with exponential backoff
 - [x] Health endpoint: add active item, revision, run ID, segment info (LOW) — implemented: full STREAMING.md contract fields
-
-## Streaming Pipeline Gaps (2026-08-10 audit — LEGACY)
-
-- [ ] Continuous R2 sync during playout (HIGH) — currently only on FFmpeg exit
-- [ ] Globally unique segment naming with run ID (HIGH) — currently strftime only
-- [ ] Atomic manifest publication with temp key (MEDIUM)
-- [ ] CORS headers on HLS responses from media.linearvoid.tv (MEDIUM)
-- [ ] Player error recovery: retries, drift, reconnecting state (MEDIUM)
-- [ ] Manifest Cache-Control: add must-revalidate + s-maxage split (LOW)
-- [ ] Health endpoint: add active item, revision, run ID, segment info (LOW)
+- [x] Phase 4 edge cache validation — script `scripts/validate-edge-cache.sh` created
 
 ## Feature List (Future Enhancements)