Harden audit findings: correctness, type-safety, Windows conventions & polish

Audit-pass over CODE-AUDIT.md (~48 items closed this pass; all verified —
typecheck + 234 tests + eslint + prettier green).

Correctness / bugs:
- B3: match the release checksum to the asset's filename line (no wrong-hash verify)
- B4: newline-safe metadata probe (one --print with a unit-separator delimiter)
- B5 / L88: guard the meta event against canceled items; progress no longer promotes
  a queued item outside pump()
- B7: cookie-login promise always resolves (handles destroy-without-close)
- L146: trim parser rejects >2 colon-group times; M36: Library selection counts only
  actionable rows
- L11 / L50 / L156 / L57 / L159 / L15 / L3: live queue count, empty-cookie message,
  schedule picker min, dead-code/comment cleanup

Type safety:
- Enable noUncheckedIndexedAccess + noFallthroughCasesInSwitch (15 real edge cases fixed)

Resilience / Windows / metadata:
- R5: settings write failure handled (no unhandled IPC rejection; reconciles to truth)
- W1 / W5 / W6: min window size, seeded folder picker, parented sign-in window;
  L147 dead macOS branches removed
- CL1: shared stdout markers; package/builder metadata (license, homepage, repository,
  copyright, tsbuildinfo glob)

Copy / docs / tests:
- M37 / SR9 dev-jargon cleanup in hints; M8 / M25 / M26 / L66 / L80 / L81 reconciled
- New unit tests for L35 (isValidMediaItem) and L36 (compareVersions)

This commit also checkpoints the previously-uncommitted feat/tray-background-clipboard
work it builds on: background running + auto-download, library clipboard detection,
tray, binary management & library scale, credential encryption at rest, the shared
jsonStore and ui/ primitives, and the eslint/prettier tooling.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main/ytdlp.ts

@@ -32,10 +32,7 @@ export function ensureManagedYtdlp(): void {
   }
 }
 
-/**
- * Step-1 spike: spawn the bundled yt-dlp and read back `--version`.
- * Proves the main-process → bundled-binary → IPC path end to end.
- */
+/** Spawn the bundled yt-dlp and read back its `--version` for the Settings panel. */
 export function getYtdlpVersion(): Promise<YtdlpVersionResult> {
   const ytdlpPath = getYtdlpPath()
 
@@ -47,16 +44,21 @@ export function getYtdlpVersion(): Promise<YtdlpVersionResult> {
   }
 
   return new Promise((resolve) => {
-    execFile(ytdlpPath, ['--version'], { windowsHide: true, timeout: 15_000 }, (err, stdout, stderr) => {
-      if (err) {
-        const msg = (err as { killed?: boolean }).killed
-          ? 'Timed out running yt-dlp.'
-          : (stderr || err.message).trim()
-        resolve({ ok: false, error: msg })
-        return
+    execFile(
+      ytdlpPath,
+      ['--version'],
+      { windowsHide: true, timeout: 15_000 },
+      (err, stdout, stderr) => {
+        if (err) {
+          const msg = (err as { killed?: boolean }).killed
+            ? 'Timed out running yt-dlp.'
+            : (stderr || err.message).trim()
+          resolve({ ok: false, error: msg })
+          return
+        }
+        resolve({ ok: true, version: stdout.trim() })
       }
-      resolve({ ok: true, version: stdout.trim() })
-    })
+    )
   })
 }