fix(producer,studio-server): finish the ffprobe argv sweep, pin the contract

The previous commit claimed "all nine now terminate their options". That
was false: `producer/src/utils/audioRegression.ts:307` still passed the
path bare, and it is production source used by the regression harness.
A repo-wide audit found two more in studio-server
(`mediaValidation.ts`, `mediaMetadata.ts`) — their current callers pass
absolute paths, so they were defence-in-depth rather than live bugs, but
the exhaustiveness claim should be true rather than narrowed.

Eleven sites total, all terminated.

Adds a SOURCE-level contract test, which is the gap that let this
happen twice. #2740 fixed one of ten sites and shipped a regression
asserting the argv of that single site, so CI reported the class closed
while nine invocations still parsed `-intro.mp4` as an option. A
per-site unit test has the same blind spot for site twelve; scanning the
tree does not. The test also asserts its own coverage list has not
shrunk.

Verification: engine 1300, lint 511, core 1431, studio-server 398, cli
init/webmAlphaCheck/whisper 146, producer utils 51, audioPadTrim 18.
Removing any single terminator fails the contract test by name.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/studio-server/src/helpers/mediaMetadata.ts

@@ -202,6 +202,7 @@ export async function probeMediaMetadata(
       "stream=codec_type,codec_name,profile,pix_fmt,color_space,color_transfer,color_primaries,bits_per_raw_sample:stream_disposition=attached_pic",
       "-of",
       "json",
+      "--",
       filePath,
     ],
     { timeout: 15_000, maxBuffer: 1024 * 1024 },

packages/studio-server/src/helpers/mediaValidation.ts

@@ -33,6 +33,7 @@ export function validateUploadedMedia(
     "stream=codec_type",
     "-of",
     "json",
+    "--",
     filePath,
   ]);