web+publisher: align moq watch client and disable passthrough by default

evolution/proposals/ECP-0063-cloudflare-moq-webtransport.md

@@ -9,7 +9,7 @@ Adopt Cloudflare's MoQ relay preview as the default "global" distribution layer
 Concrete changes:
 
 1. `ec-node` gains a WebTransport MoQ publisher path that can publish a live CMAF (fMP4) stream to a relay URL (default: `https://cdn.moq.dev/anon`).
-2. `every.channel` (the deployed static site) becomes a real web watcher by embedding a WebTransport-capable MoQ player component (`<hang-watch>`).
+2. `every.channel` (the deployed static site) becomes a real web watcher by embedding a WebTransport-capable MoQ player component (`<moq-watch>` from `@moq/watch`).
 3. The existing WebRTC/WS bootstrap directory/relay remains temporarily for compatibility, but is treated as deprecated once MoQ/WebTransport is stable.
 
 ## Motivation
@@ -48,11 +48,19 @@ As of February 21, 2026, browser sessions against `https://interop-relay.cloudfl
 
 ### Web player
 
-Use the `@kixelated/hang` web component:
-- `<hang-watch url="..." name="..." controls>`
+Use the `@moq/watch` web component:
+- `<moq-watch url="..." path="...">`
 
 This is WebTransport + WebCodecs based, and is expected to interoperate with Cloudflare's current relay preview.
 
+### CMAF passthrough default
+
+`ec-node wt-publish` defaults `--passthrough=false` (and Nix module default `passthrough = false`).
+
+Reason:
+- Browser `@moq/watch` playback against live OTA ingest currently hits repeated `Invalid sample duration 0 in trun` decode failures when fed raw passthrough fMP4 fragments.
+- Non-passthrough mode avoids this incompatibility and restores end-to-end playback reliability.
+
 ### Transport compatibility
 
 Cloudflare's public relay currently implements a subset of the IETF MoQ Transport draft-07 and may not interoperate with