favicon hijack + tonemap fix shipped to prod

Favicon: prod's older lockFavicon() shim was clobbering our injected
A-logo <link> tags every head mutation. Tag our links with
data-arrflix-icon="A" + add a hijack IIFE that re-pins the A URL on
matching tags AND removes any other large data:image/png link tags.

Tonemap: encoding.xml flipped EnableTonemapping false to true on dev
+ prod (server-side, not in repo). Doc 21 documented this fix
2026-05-08; prod was still grey-washing HDR10 sources because
setparams was relabeling PQ pixels as bt709 without zscale + tonemap
conversion. API now reports EnableTonemapping=True. Next HDR10
transcode gets the proper zscale -> tonemap -> format ffmpeg chain.

Both verified on dev first then promoted. Prod overlay md5 c6c85076
to 364cc890. dev and prod overlay byte-identical.

bin/inject-middle-theme.py

@@ -119,17 +119,34 @@ JS = """
 
 FAVICON_LINKS = (
     "<!--ARRFLIX-FAVICON-BEGIN-->"
-    "<link rel=\"icon\" type=\"image/png\" sizes=\"180x180\" href=\"data:image/png;base64," + logo_a_b64 + "\">"
+    "<link rel=\"icon\" type=\"image/png\" sizes=\"180x180\" data-arrflix-icon=\"A\" href=\"data:image/png;base64," + logo_a_b64 + "\">"
-    "<link rel=\"apple-touch-icon\" sizes=\"180x180\" href=\"data:image/png;base64," + logo_a_b64 + "\">"
+    "<link rel=\"apple-touch-icon\" sizes=\"180x180\" data-arrflix-icon=\"A\" href=\"data:image/png;base64," + logo_a_b64 + "\">"
     "<!--ARRFLIX-FAVICON-END-->"
 )
+FAVICON_HIJACK_JS = (
+    "<script>/* ARRFLIX-FAVICON-HIJACK-BEGIN */"
+    "(function(){"
+    "var A_URL='data:image/png;base64," + logo_a_b64 + "';"
+    "function pin(){"
+    "Array.prototype.forEach.call(document.querySelectorAll('link[rel=\"shortcut icon\"], link[rel=\"icon\"], link[rel=\"apple-touch-icon\"]'),function(l){"
+    "if(l.getAttribute('data-arrflix-icon')==='A')return;"
+    "if((l.href||'').indexOf('data:image/png')!==-1 && l.href.length>200 && l.getAttribute('data-arrflix-icon')!=='A'){l.parentNode&&l.parentNode.removeChild(l);}"
+    "});"
+    "Array.prototype.forEach.call(document.querySelectorAll('link[data-arrflix-icon=\"A\"]'),function(l){if(l.href!==A_URL) l.href=A_URL;});"
+    "}"
+    "function start(){pin();try{new MutationObserver(pin).observe(document.head||document.documentElement,{childList:true,subtree:true,attributes:true,attributeFilter:['href']});}catch(e){}setInterval(pin,1000);}"
+    "if(document.readyState==='loading')document.addEventListener('DOMContentLoaded',start,{once:true});else start();"
+    "})();"
+    "/* ARRFLIX-FAVICON-HIJACK-END */</script>"
+)
 
 src = target.read_text(encoding="utf-8")
 src = re.sub(re.escape("<style>" + START) + r".*?" + re.escape(END + "</style>"), "", src, flags=re.DOTALL)
 src = re.sub(re.escape("<script>" + START) + r".*?" + re.escape(END + "</script>"), "", src, flags=re.DOTALL)
 src = re.sub(r"<!--ARRFLIX-FAVICON-BEGIN-->.*?<!--ARRFLIX-FAVICON-END-->", "", src, flags=re.DOTALL)
+src = re.sub(r"<script>/\* ARRFLIX-FAVICON-HIJACK-BEGIN \*/.*?/\* ARRFLIX-FAVICON-HIJACK-END \*/</script>", "", src, flags=re.DOTALL)
 
-PATCH = "<style>" + START + CSS + END + "</style>" + "<script>" + START + JS + END + "</script>" + FAVICON_LINKS
+PATCH = "<style>" + START + CSS + END + "</style>" + "<script>" + START + JS + END + "</script>" + FAVICON_LINKS + FAVICON_HIJACK_JS
 if "</head>" not in src:
     sys.exit("no </head> in target")
 src2 = src.replace("</head>", PATCH + "</head>", 1)