Harden media verification, recovery, and watch-mode safety

[quinnuk]

What changed

• Reuse the full output verification logic both before replacement and after replacement.
• Verify retained audio tracks as complete per-track signatures instead of independent property sets.
• Verify subtitle properties and video track properties as well as counts.
• Preserve an existing Maximum Safety Mode backup instead of overwriting it.
• Restore from backup with a copy so persistent backups remain available after rollback.
• Retry dependency discovery after a cached negative find_tool() result.
• Make watch mode retry transient processing errors instead of permanently marking them processed.
• Track processed-file identity using size/mtime so replacement files at the same path are reconsidered.
• Add regression tests for exact track verification, Maximum Safety Mode recovery, and watcher behaviour.

Why

These changes close the remaining safety gaps identified during code review, particularly around post-replacement verification and false-positive track validation.

Validation

GitHub Actions will run the repository's existing test and build workflows for this pull request.