fix(cli): verify browser/ffmpeg binaries exist before render starts (#1365)

## Problem

Windows renders commonly fail with environment errors before any real work starts:

- `Browser was not found at the configured executablePath (...chrome-headless-shell.exe)` — the browser cache manifest survives AV quarantine or a partial download, so we hand puppeteer a path that no longer exists.
- `[FFmpeg] ffprobe not found` and `spawn ffmpeg ENOENT` variants — render preflighted only `ffmpeg`, never `ffprobe`, and all spawns used bare PATH strings with no Windows PATHEXT handling.

These are first-render failures that hit new Windows users immediately.

## Fix

- Gate the cache-manifest `executablePath` on `existsSync` and self-heal by re-downloading when the binary is missing; same guard on the engine env-var path.
- New shared environment preflight (`packages/cli/src/browser/preflight.ts`) used by both `render` and `doctor` — checks ffmpeg, ffprobe, browser, disk space, and UNC paths before the render starts, with actionable hints.
- Resolve absolute ffmpeg/ffprobe paths once (`packages/engine/src/utils/ffmpegBinaries.ts`) and pass them to every engine spawn instead of relying on PATH.
- Map opaque Windows ffmpeg exit codes to actionable messages.

## Testing

- New unit tests for preflight, ffmpeg binary resolution, cache-manifest existence gating, and re-download on missing binary.
- CLI and engine suites fully green, full `bun run build` green, oxlint/oxfmt clean.
- Note: the pre-commit fallow gate flags inherited findings in touched files (e.g. `audioExtractor.ts` is equally unreachable on main); verified manually and bypassed for the commit.

packages/engine/src/services/browserManager.test.ts

@@ -11,6 +11,7 @@ import {
   drainBrowserPool,
   forceReleaseBrowser,
   releaseBrowser,
+  resolveHeadlessShellPath,
   resolveBrowserGpuMode,
 } from "./browserManager.js";
 
@@ -137,6 +138,23 @@ describe("resolveBrowserGpuMode", () => {
   });
 });
 
+describe("resolveHeadlessShellPath", () => {
+  const originalHeadlessShellPath = process.env.PRODUCER_HEADLESS_SHELL_PATH;
+
+  afterEach(() => {
+    if (originalHeadlessShellPath === undefined) delete process.env.PRODUCER_HEADLESS_SHELL_PATH;
+    else process.env.PRODUCER_HEADLESS_SHELL_PATH = originalHeadlessShellPath;
+  });
+
+  it("throws a clear error when PRODUCER_HEADLESS_SHELL_PATH points at a missing binary", () => {
+    process.env.PRODUCER_HEADLESS_SHELL_PATH = "/missing/chrome-headless-shell.exe";
+
+    expect(() => resolveHeadlessShellPath({})).toThrow(
+      /Chrome binary not found at PRODUCER_HEADLESS_SHELL_PATH/,
+    );
+  });
+});
+
 describe("forceReleaseBrowser", () => {
   it("kills the browser process and disconnects", () => {
     const killFn = vi.fn(() => true);