fix(engine): validate remote download integrity

[jrusso1020]

Summary

• Reject unsolicited or malformed 206 and Content-Range on 200 responses.
• Validate declared length, streamed bytes, local size, supported media signatures, HTML or JSON error bodies, and caller or server checksums before publication.
• Keep unique private partials, fsync, and atomic no-clobber hard-link publication so concurrent downloads never replace a returned file.
• Emit query-free URL fingerprint and host, status, expected and received bytes, hashed ETag, local size and SHA-256 without signed URL, statusText, or remote error-body leakage.
• Perform at most one clean refetch for transient network, short-read, range, and hash failures; deterministic invalid payloads remain non-retryable.

Validation

• Downloader suite: 50 passing, including extensionless and wrong MIME success, truncated first GET then complete GET, malformed range, hostile statusText, checksum modes, concurrent publication, and TS, M2TS, and MXF signatures.
• Related error-classification and audio suites: 34 passing.
• Full engine suite: 1,257 passing, 3 skipped.
• Full producer unit lane: 450 Vitest tests plus all Bun unit files passing.
• Full producer integration lane: all Vitest and Bun integration files passing.
• Engine, producer, and CLI typechecks and build gates passing.
• Pre-commit tracked-artifact, lint, format, fallow, and typecheck gates passing.
• Independent adversarial review: no blockers.

Scope

HDR behavior and hyperframes-internal dependency or version changes are intentionally out of scope.

Rollback

Revert commit 2e45c0b. Downloaded temporary files are not persisted across attempts and no migration is introduced.