fix(engine): preserve bounded ffprobe diagnostics

[jrusso1020]

What

• centralize engine ffprobe calls on -v error instead of suppressing all diagnostics with -v quiet
• retain only the final 8 KiB of stderr, replace the exact input path, apply the existing telemetry redactor, and cap the surfaced diagnostic at 4 KiB
• continue to ignore stderr when ffprobe exits successfully
• cover paths containing spaces, tail preservation, bounds, argument ordering, and successful probes that write stderr

Why

In the reviewed Hyperframes production window, 46 render failures reached producer_renderer_error with blank ffprobe stderr. That affected 46 workflows, 41 request IDs, and 40 parent requests. With -v quiet, we cannot distinguish invalid user media from a renderer/system failure, so these cases are not actionable and cannot be classified safely.

Safety

• no change to ffprobe stdout parsing, exit handling, cache behavior, fallback behavior, retry policy, or render routing
• no new metric tags or unbounded telemetry
• input paths are removed before the existing generic telemetry redaction
• only the retained stderr tail is surfaced, so the useful terminal error is preserved within fixed memory/error bounds

Validation

• ffprobe.test.ts: 20/20 passed
• engine suite: 1,154 passed, 3 integration tests skipped
• engine typecheck passed
• changed-file lint and format checks passed
• Fallow changed-file audit passed
• independent review: approved with no blocking findings