build(aws-lambda): pinned native ffmpeg build for an arm64 Lambda image

One recipe, run per architecture on the Lambda Node 22 base it ships on. Codec
libraries link statically; glibc and GnuTLS stay dynamic, with the two libraries
the bare base lacks bundled beside the binaries. A check stage on the bare base
proves every encoder, decoder, filter and protocol the engine calls, and the
artifact cannot be produced without it. CI builds it on two ARM runners and
requires byte-identical tarballs.

.github/workflows/lambda-ffmpeg.yml

@@ -0,0 +1,47 @@
+name: Lambda arm64 ffmpeg
+
+permissions:
+  contents: read
+
+# Builds the native ffmpeg for the arm64 Lambda video function on two separate ARM runners.
+# Each build runs the codec check on the bare Lambda base; the tarballs must be byte-identical.
+on:
+  pull_request:
+    paths:
+      - "packages/aws-lambda/ffmpeg/**"
+      - ".github/workflows/lambda-ffmpeg.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: lambda-ffmpeg-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build ${{ matrix.copy }}
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 90
+    strategy:
+      matrix:
+        copy: [a, b]
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Build and check
+        run: >-
+          docker buildx build --progress=plain --platform linux/arm64 --target artifact
+          --output type=local,dest=out packages/aws-lambda/ffmpeg
+      - run: cat out/hf-media-check.txt && sha256sum out/*.tar.gz
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: hf-media-${{ matrix.copy }}
+          path: out/
+          retention-days: 7
+
+  reproducible:
+    name: Builds match
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - run: cmp hf-media-a/hf-media-linux-aarch64.tar.gz hf-media-b/hf-media-linux-aarch64.tar.gz