fix(skills,producer): terminate ffprobe options in shipped skill scripts

The contract test only walked packages/*/src and only .ts, so it could not see
the shipped agent tools under skills/**, which are .mjs/.cjs. 19 call sites
there and in package tests were still missing `--` immediately before the
input while the suite reported the bug class closed — a dash-prefixed filename
is parsed as an option and fails the same way.

Sweeps packages/, skills/ and scripts/ now, including .mjs/.cjs and test
files (dither.test.mjs was one of the broken sites). Excludes only the
contract test itself, which documents the contract with example argvs
including a deliberately misordered one.

Two guards were fixed while widening: the terminator must never be inserted
after `-i`, which consumes the next token (a blind pass hit an ffmpeg input
and a base64 -i), and comment prose describing a spawn is not a spawn.

Also routes every audioPadTrim probe failure through one sanitizer at the
boundary. runFfprobeJson scrubbed its own stderr, but
defaultProbeVideoFrameInfo threw `no video stream in ${videoPath}` raw into
the public PadTrimAudioResult.error, and an injected probe can throw anything.
The redaction unit tests all passed with the caller wiring deleted; the new
public-path regressions fail without it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/producer/tests/distributed/_smoke/webm-concat-copy.test.ts

@@ -213,6 +213,7 @@ describe("webm VP9 concat-copy smoke", () => {
       "stream=codec_name,width,height,pix_fmt,r_frame_rate",
       "-of",
       "default=noprint_wrappers=1",
+      "--",
       outputPath,
     ]);
     if (result.exitCode !== 0) {
@@ -268,6 +269,7 @@ describe("webm VP9 concat-copy smoke", () => {
       "stream=nb_read_frames",
       "-of",
       "default=noprint_wrappers=1:nokey=1",
+      "--",
       outputPath,
     ]);
     if (result.exitCode !== 0) {
@@ -423,6 +425,7 @@ describe("webm VP9 concat-copy smoke (yuva420p alpha)", () => {
         "-select_streams",
         "v:0",
         "-show_streams",
+        "--",
         alphaOutputPath,
       ]);
       expect(probeResult.exitCode).toBe(0);