fix(main): L136 — enforce incognito in main (no errorlog / toast / cookie leak)

Incognito lived only in the renderer (history skip), so a "private" download
still leaked in main: errorlog entries (title+URL), OS toasts showing the title,
and the signed-in cookies attached — the UI promised "no logging, no history, no
cookies" but only history held.

Plumb `incognito` through StartDownloadOptions and enforce it in main:
- logFailure skips the errorlog write (and the pre-spawn errorlog in ipc.ts).
- notify uses a generic outcome title and drops the detail body, so no title/URL
  lands in the Windows Action Center.
- both cookie sources (--cookies login jar, --cookies-from-browser) are withheld,
  so a private download can't be tied to the user's identity.

typecheck + 262 tests + eslint + prettier green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/shared/ipc.ts

@@ -423,6 +423,13 @@ export interface StartDownloadOptions {
   formatId?: string
   /** whether the chosen format already includes audio (skips +bestaudio) */
   formatHasAudio?: boolean
+  /**
+   * Incognito ("private") download. Main enforces the promise the UI makes ("no
+   * logging, no history, no cookies"): it writes no errorlog entry, reveals no
+   * title/URL in an OS notification, and attaches no saved login / browser
+   * cookies — not just the renderer's history skip (L136 / M6).
+   */
+  incognito?: boolean
   /** per-download post-processing override; main falls back to settings defaults */
   options?: DownloadOptions
   /**