9.0.3

New version scheme

This release is 9.0.3 rather than 1.62. The version now tracks the FFmpeg release the
script builds:

<ffmpeg major>.<ffmpeg minor>.<n>

where n counts the releases of this script against that FFmpeg version. So 9.0.3 is the
third release that builds FFmpeg 9.0, following V1.60 and V1.61. A move to FFmpeg 9.1 would
start again at 9.1.1.

The old 1.x numbering ran independently of FFmpeg, so the version told you nothing about
which FFmpeg you were about to build. Nothing else changes: --version still prints the
number, and pinning an install to a tag still works the same way.

Fixes

• harfbuzz not found using pkg-config on hosts that have libharfbuzz-dev installed
  (#266). FreeType and
  harfbuzz depend on each other and FreeType is built first, so harfbuzz is not in the
  workspace when its configure runs. Left to autodetect, FreeType linked against the
  system harfbuzz: libfreetype.a came out carrying hb_shape references and
  freetype2.pc gained Requires.private: harfbuzz, forming a pkg-config cycle with the
  workspace harfbuzz built later. FFmpeg's link test flattened that cycle into an order where
  hb_shape stayed unresolved, and reported the misleading error above. FreeType is now built
  with --with-harfbuzz=no; the only thing given up is harfbuzz-assisted auto-hinting inside
  FreeType, and shaping for libass and drawtext is unaffected.

  This went unnoticed for a release because every CI job built on a host with almost no -dev
  packages, while real users build on full desktop distributions. There is now a CI job that
  installs exactly those packages, so the contaminated-host case is covered.

• build_harfbuzz says why it skipped when meson is missing, instead of returning
  silently.

Installation

The one-liner installers now fetch the latest release instead of whatever had just been
merged to master. They resolve the newest tag, download that release's source archive,
extract it and build from it.

Previously they piped the raw master script straight into bash. That meant every new user
got unreleased work, and curl ran without --fail, so an HTTP error page could be executed
as a script and a download cut short halfway would run its own first half. The archive is now
downloaded in full before anything runs.

FFMPEG_BUILD_SCRIPT_REF pins a specific release (FFMPEG_BUILD_SCRIPT_REF=v9.0.3) or
selects a branch (master) for unreleased work.

Maintenance

Nothing here changes what gets built, but it is most of the diff.

• The script is no longer one file. build-ffmpeg had grown to 3,529 lines; it is now a
  small entry point that sources fragments from src/, the largest of which is 656 lines.
  There is no build or assembly step — the fragments are the source, and every install path
  already ships the whole tree. Verified byte-identical: with comments and blank lines
  stripped, the fragments concatenate to exactly the previous file.
• Each package's version and checksum now sit next to the function that builds it, rather
  than in one table two thousand lines away. download() derives the array name from the name
  passed to build(), and when those drifted apart the checksum was silently skipped rather
  than failing.
• --list-packages prints the build order with each version and whether it is pinned. It
  resolves them through the same helper download() uses, so a name that has drifted shows up
  as MISSING.
• CI now checks both of those in the lint job, in seconds, instead of leaving them to surface
  an hour into a build.

Upgrading

No action needed. The install one-liners are unchanged, and a git clone still runs
./build-ffmpeg --build exactly as before.

If you have automation that downloads the single build-ffmpeg file directly from master,
that no longer works on its own — it needs the src/ directory beside it. Use the installer,
a release archive, or a clone. The script says so if it cannot find src/.