fix(cli): retain the audio track when scaffolding from an audio file

[kapelame]

What

hyperframes init demo --audio track.wav --non-interactive --skip-transcribe succeeds and copies the source file, but the generated composition contains no audio element. The same source is also lost during interactive initialization.

Why

Only the video basename reaches the shared scaffolder. With an audio-only input that basename is absent, so the placeholder patcher removes both media elements and the resulting composition is silent.

How

Pass the audio basename through both initialization paths. Preserve and fill the template's audio element while removing its unused video element. Existing video initialization and blank templates retain their current behavior.

Test plan

• Unit tests added/updated. In this isolated worktree, HYPERFRAMES_NO_TELEMETRY=1 bunx --no-install vitest run packages/cli/src/commands/init.test.ts passes all 28 tests. The subprocess regression executes this worktree's cli.ts and verifies its generated audio reference, absence of a video clip, and copied WAV contents.
• Automated CLI and headless Chrome smoke checks: a real one-second WAV changed from zero audio elements to one; static lint and the browser gate both returned ok: true.
• Documentation updated (not applicable; restores the existing --audio behavior).

This branch contains only the two initialization files. It applies directly to f6041d7597c8c53d381d4c27feb86b305b3317a4. Dependencies were installed separately; reused generated files belong only to unchanged packages. Source and workspace dependency resolution were checked to remain inside this worktree. Targeted oxlint, oxfmt and diff checks pass; the configured pre-commit and commit-message hooks run normally through this worktree's Lefthook binary.

The full workspace build passed earlier in the audit, while the initialization fix was still being completed. All workspace typechecks subsequently passed with the initialization and GIF fixes applied. After adding the separate download fix, the final combined checkout passed the CLI build and typecheck, repository lint/format checks, and CLI suite (3,213 passed, 3 skipped). These broader gates were not rerun after splitting this standalone branch; its 28 initialization tests were rerun here.

The combined workspace run retained unrelated baseline/environment limitations: an AAC loudness assertion also fails with the original base implementation, and Node 25 native Web Storage initially conflicts with Player/Studio tests. Disabling that native feature passes all 370 Player tests and all 120 tests in the affected Studio files. The headless browser check retains the existing one-second WAV versus ten-second fallback-slot warning when transcription is skipped. Node 22, Linux/Windows and cloud rendering were not exercised locally.

Additional verification of the final combined state: after confirming that the original audit checkout contained exactly the three reviewed patches on f6041d7597c8c53d381d4c27feb86b305b3317a4, HYPERFRAMES_NO_TELEMETRY=1 bun run build and HYPERFRAMES_NO_TELEMETRY=1 bun run --filter '*' typecheck were rerun and both passed. Before/after source and diff hashes are identical. These new whole-workspace results cover the final three-fix combination; this standalone branch's own focused tests and hook checks remain documented separately above.

Current-upstream integration check: the three reviewed patches were also applied to a separate checkout of a0a6244be7a40956c5343f5846609e584ee5c6b5. With independent dependencies and a freshly rebuilt current Core runtime, 388 focused tests passed: audio route/transport (97), capture classification (19), render orchestration (222), GIF preparation/compiler (10), and init/download (40). A real local Chrome/FFmpeg smoke check reused the init-generated audio element in a minimal two-second scene with a finite-loop GIF and data-loop="false"; output was 160×90 H.264/AAC, 10 frames, 2.000 seconds, with one GIF playback and a 1.6-second tail hold. The screenshot retry branches were checked by unit tests, not an injected browser failure. Source/diff hashes remained unchanged. This verifies the combined patches against that upstream SHA; the independent commit and its original base remain unchanged.