feat: Phase P reliability (YouTube extractor-args plumbing, signing + smoke-test docs)

- YouTube reliability: Settings.youtubePlayerClient + youtubePoToken ->
  one --extractor-args "youtube:player_client=...;po_token=..." group
  (accessArgs, unit-tested); advanced fields in Settings -> Network.
  Automatic WebView PO-token minting deferred (documented).
- docs/SMOKE-TEST.md: release-gate checklist for all shipped-but-untested
  OS wiring (cookies window, protocol/Send-to, scheduled sync, aria2c, proxy,
  tray/taskbar/pause-resume/terminal) — needs a human to run.
- docs/SIGNING.md: code-signing guide (CSC_LINK/CSC_KEY_PASSWORD, OV/EV,
  CI, HSM hook, verification). Build is signing-ready; needs a cert.
- i18n remains deferred (not faked).

typecheck + test (195) + build all clean. Roadmap: Phase P code shipped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

test/buildArgs.test.ts

@@ -461,6 +461,28 @@ describe('sidecar files', () => {
   })
 })
 
+describe('YouTube extractor-args', () => {
+  it('combines player_client and po_token into one youtube: group', () => {
+    const argv = build(opts(), dlo(), {
+      ...NO_ACCESS,
+      youtubePlayerClient: 'web_safari',
+      youtubePoToken: 'web.gvs+ABC'
+    })
+    expect(hasSeq(argv, '--extractor-args', 'youtube:player_client=web_safari;po_token=web.gvs+ABC')).toBe(
+      true
+    )
+  })
+
+  it('emits only the fields that are set', () => {
+    const argv = build(opts(), dlo(), { ...NO_ACCESS, youtubePlayerClient: 'tv' })
+    expect(hasSeq(argv, '--extractor-args', 'youtube:player_client=tv')).toBe(true)
+  })
+
+  it('emits nothing when both are empty', () => {
+    expect(build(opts(), dlo(), NO_ACCESS)).not.toContain('--extractor-args')
+  })
+})
+
 describe('format sorting (-S)', () => {
   it('emits a raw -S string when formatSort is set, overriding the codec tiebreaker', () => {
     const argv = build(opts(), dlo({ formatSort: 'res:1080,vcodec:av01', preferredVideoCodec: 'h264' }))