A freshly downloaded replacement has to go through the SAME pipeline as the library - same bpp
tier rule, same gates, same hash-verified install - rather than a hand-rolled ffmpeg one-off. So:
--path converts one file anywhere on disk (its tier is still chosen by bpp; the dest defaults next
to it), --dest installs the result at an exact path (e.g. back into the library), --keep-source
never deletes the source after a verified install. Also fixes a cross-drive crash: os.path.relpath
raises ValueError when the file is on D: and the library on Z:, so logs/ledger fall back to the
absolute path (measured on the first run of this feature).