fix(main): L136 — enforce incognito in main (no errorlog / toast / cookie leak)

Incognito lived only in the renderer (history skip), so a "private" download
still leaked in main: errorlog entries (title+URL), OS toasts showing the title,
and the signed-in cookies attached — the UI promised "no logging, no history, no
cookies" but only history held.

Plumb `incognito` through StartDownloadOptions and enforce it in main:
- logFailure skips the errorlog write (and the pre-spawn errorlog in ipc.ts).
- notify uses a generic outcome title and drops the detail body, so no title/URL
  lands in the Windows Action Center.
- both cookie sources (--cookies login jar, --cookies-from-browser) are withheld,
  so a private download can't be tied to the user's identity.

typecheck + 262 tests + eslint + prettier green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/renderer/src/store/downloads.ts

@@ -114,6 +114,9 @@ export const useDownloads = create<DownloadState>((set, get) => {
         options: item.options,
         extraArgs: item.extraArgs,
         trim: item.trim,
+        // Carry the private flag to main so it also skips errorlog, notification
+        // detail, and cookies — not just the renderer's history skip (L136).
+        incognito: item.incognito,
         meta: item.probedMeta,
         collection: item.collection
       })