feat: add secure Jellyfin FFmpeg runtime foundation

[jahvari]

Summary

• pin an immutable Jellyfin FFmpeg v7.1.4-3 Windows x64 runtime manifest with exact URL, size, digest, executable paths, and version identity
• resolve and lease authenticated FFmpeg/ffprobe pairs without mutating PATH or allowing executable identity changes while in use
• supervise every media-process tree with bounded output, deadlines, cancellation, and confirmed reaping on Windows and Unix
• securely acquire, validate, extract, activate, recover, and roll back the managed Windows runtime using receipts and atomic selection
• harden package/release workflows so runtime-bearing artifacts are enumerated and verified before publication

Scope

This is PR 2 of the hardware-transcoding sequence and contains Tasks 4–6 only. It provides the secure runtime and process-lifecycle foundation; it does not enable GPU acceleration, migrate HLS/casting, implement source probing, or start Task 7.

Platform policy in this PR:

• Windows may acquire the pinned managed runtime.
• Linux discovers and verifies administrator-installed Jellyfin FFmpeg packages but does not download one automatically.
• macOS has no managed-download path in this PR.

Security properties

• exact HTTPS hosts and bounded redirect chain; no implicit redirects
• bounded download size, idle deadline, overall deadline, and SHA-256 validation
• archive authentication remains bound to the opened handle used for extraction
• strict required-path allowlist and path/reparse/link/collision rejection
• protected managed root, receipt-backed installation, atomic activation, restart-stable rollback, and cancellable interprocess locking
• immutable executable snapshots/leases and safe public runtime identity
• Windows Job Objects and Unix process groups retain ownership until descendants and pipe readers are terminally joined
• bounded stdout/stderr, spawn deadlines, cancellation grace, force termination, and confirmed reap

Verification

• cargo fmt --all -- --check
• strict Clippy for fake-media-tool and server/librqbit with -D warnings
• cargo test -p fake-media-tool — 27 passed
• cargo test -p server --no-default-features --features librqbit -- --test-threads=1 — 259 passed, 0 failed, 10 intentionally ignored fixture/qualification tests
• libtorrent feature graph confirms the compatibility test's direct test-only librqbit dependency
• full public-diff scan: no credentials, private keys, personal paths, local memory/docs, debug logs, runtime binaries, or archives

Qualification boundary

This source PR does not publish a runtime or release artifact. Before a public managed-runtime release, the project still requires real pinned GitHub/CDN install/restart/corruption/switch/rollback smoke tests, native Linux/macOS/package-loader qualification, post-build package gates, and distribution/license/source/SBOM owner signoff.

Follow-up

Task 7 begins the validated media-source broker and bounded typed probing. Hardware device selection, codec recipes, persistent playback sessions, HLS/casting migration, settings, and telemetry remain later PRs.