feat: record at the source's size, only once capture works

Encoders and the segment output are created when the capture source first
has a picture, at its own size (portrait monitors record portrait) unless a
resolution is configured, so nothing is written while waiting for a source.
SPEC.md records both decisions; validation docs cover how sessions should end
when the game closes.

scripts/validate/linux-rig.sh

@@ -101,13 +101,15 @@ else
     result "${name}" 1
 fi
 
-# 8. The portal refuses the request: an actionable failure, never Recording.
+# 8. The portal refuses the request: an actionable failure, never Recording,
+#    and no footage written (output starts only once capture has a picture).
 name=portal-refused
 CLIPBIN_RIG_PORTAL_OUTPUT=NO-SUCH-OUTPUT "${rig}" "${probe}" record --seconds 8 --out "${out}/${name}" \
     > "${out}/${name}.log" 2>&1
 probe_exit=$?
 if [[ "${probe_exit}" != 0 ]] && ! has "${out}/${name}.log" "status=Recording" \
-    && has "${out}/${name}.log" "status=failed reason=screen capture was not allowed"; then
+    && has "${out}/${name}.log" "status=failed reason=screen capture was not allowed" \
+    && [[ -z "$(ls -A "${out}/${name}/session" 2>/dev/null)" ]]; then
     result "${name}" 0 "$(grep -m1 -o 'status=failed reason=.*' "${out}/${name}.log")"
 else
     result "${name}" 1