Bundle ffprobe.exe and complete the real-download smoke-test pass

A live smoke test of buildArgs' argv against the bundled yt-dlp + ffmpeg found
that ffprobe.exe was never bundled (resources/bin/ shipped only ffmpeg.exe).
yt-dlp resolves both from --ffmpeg-location, so duration-aware post-processing
failed at runtime for every user with "ffprobe not found": --sponsorblock-remove,
--force-keyframes-at-cuts, and --split-chapters (CODE-AUDIT C1).

- Bundle ffprobe.exe (matching n8.1.2 LGPL build, sha256-verified against the
  already-bundled ffmpeg.exe) and document it in resources/bin/README.md as a
  required binary; correct the stale "not committed to git" note.
- Guard startDownload against a missing ffmpeg.exe/ffprobe.exe up front so the
  failure is a clear AeroFetch error, not a cryptic yt-dlp postprocessing one
  (new getFfprobePath() in binaries.ts).
- Expand test/real-download.integration.test.ts from 2 to 8 live cases: crop,
  sponsorblock-remove, audio opus re-encode, mkv+vp9 merge, subtitle+chapter
  embed, restrict-filenames, download-archive skip, and Phase C extra-args.
  All 8 pass against live yt-dlp + ffmpeg.
- ROADMAP: mark the Phase A/B/C smoke-test caveats done. CODE-AUDIT: add C1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ROADMAP.md

@@ -27,8 +27,12 @@ choices end-to-end. Persisted defaults are editable in **Settings → Format &
 post-processing** via a reusable `DownloadOptionsForm` component, which the download
 bar also hosts in a collapsible per-download **Options** panel. The main process emits
 the flags in `buildArgs` (`src/main/download.ts`). All items verified in the UI preview
-(typecheck clean). *Caveat: the option flags themselves were validated by reasoning +
-typecheck, not yet by live yt-dlp downloads — worth a real-download smoke test pass.*
+(typecheck clean). **Real-download smoke test ✅ (2026-06-23):** crop-to-square cover,
+audio re-encode (opus), video container + codec preference (mkv + vp9 merge), subtitle
+embed (→ mov_text), chapter embed, and SponsorBlock-remove (output duration shrinks by the
+cut segments) are now all verified against live yt-dlp + ffmpeg in
+[real-download.integration.test.ts](test/real-download.integration.test.ts). That pass
+found and fixed a real shipping bug — the bundled `ffprobe.exe` was missing (see CODE-AUDIT C1).
 
 - [x] **Playlist downloads.** Probe now uses `yt-dlp -J --flat-playlist` and returns either
       a single video (with formats) or a flat playlist. The download bar shows a selection
@@ -45,7 +49,8 @@ typecheck, not yet by live yt-dlp downloads — worth a real-download smoke test
       overriding the requested resolution.
 - [x] **Embed chapters.** `--embed-chapters` toggle. (`--split-chapters` still TODO.)
 - [x] **Embed thumbnail crop-to-square** for audio (Seal's "crop artwork") via thumbnail
-      post-processor args. *Implemented; needs a real-download smoke test of the ffmpeg crop recipe.*
+      post-processor args. *Smoke-tested ✅: the embedded cover comes out a perfect square
+      (360×360) — the `--ppa` crop recipe survives yt-dlp's shlex split + ffmpeg's filtergraph.*
 - [x] **Per-download overrides.** Collapsible Options panel in the download bar (shared
       `DownloadOptionsForm`) so one download — or one playlist batch — can deviate from the
       persisted defaults; "Reset to defaults" clears it. Threads `options` through
@@ -55,11 +60,13 @@ typecheck, not yet by live yt-dlp downloads — worth a real-download smoke test
 
 `buildArgs`'s former `NetworkOptions` param is now `AccessOptions` (still in
 `src/main/buildArgs.ts`) — it grew past pure networking once cookies and
-filename/archive flags joined proxy/rate-limit/aria2c. *Caveat: the sign-in
-window's cookie export is implemented per the Electron session-cookie and
-Netscape cookie-jar formats and verified by reasoning + typecheck, not yet by
-an actual live login → yt-dlp download against a gated video — worth a real
-smoke test.*
+filename/archive flags joined proxy/rate-limit/aria2c. **Smoke-tested ✅ (2026-06-23):**
+`--restrict-filenames` (spaces → underscores) and `--download-archive` (a second run of
+the same URL is skipped with no fresh download) are verified end-to-end. *Still untested
+live: the sign-in window's cookie export — it needs an interactive login against a gated
+video, which can't run unattended, so it stays reasoning + typecheck only. aria2c
+(optional, binary not bundled) and proxy (needs a live proxy server) are likewise not
+smoke-tested.*
 
 - [x] **Cookies.** Settings → Cookies has a source picker:
       - *From a browser's cookie store* → `--cookies-from-browser <name>` (chrome/edge/
@@ -101,9 +108,9 @@ download override that default or opt out entirely (`extraArgs` on
 options/extraArgs resolution, shared by both the real `startDownload` spawn and the new
 preview path. All items verified in the UI preview + `npm run typecheck` +
 `npm run test` (11 new unit tests covering `parseExtraArgs`, `formatCommandLine`, and
-extraArgs ordering). *Caveat: the extra-args splitting and command construction were
-validated by reasoning + tests, not yet by a real yt-dlp run with actual custom flags —
-worth a real-download smoke test pass, same as Phase A/B.*
+extraArgs ordering). **Smoke-tested ✅ (2026-06-23):** `parseExtraArgs('--write-info-json
+--no-mtime')` splits into discrete tokens and the flags reach a live yt-dlp run — the
+`.info.json` sidecar is written, confirming custom-command args take effect end-to-end.
 
 - [x] **Custom command templates.** Named, editable templates of extra yt-dlp args
       (`CommandTemplate`), CRUD'd inline via `TemplateManager.tsx`; persisted to