修复本地开发安装setup:engines哈希值预期不一致导致安装报错

[weeeeeeee-der]

Running npm run setup:engines on Windows failed because the rolling FFmpeg latest asset no longer matched the SHA-256 locked in the engine manifest.

This PR pins FFmpeg / FFprobe to the immutable BtbN autobuild-2026-08-21-13-40 archive, synchronizes the third-party notice, and adds license checks that reject /latest/ URLs and manifest/notice drift.

Verified with:

• npm run verify:engines:windows
• npm run verify:licenses
• npm run verify:licenses:windows
• npm test
• npm run build

Closes #16

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 34022c63ca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep the FFmpeg notice in sync with the pinned archive

When this source URL is changed from the moving latest asset to the pinned autobuild, the FFmpeg section of licenses/THIRD_PARTY_NOTICES.txt still identifies the old latest/ffmpeg-n8.1-latest...zip archive as the release archive. For Windows packages restored from this manifest, the shipped third-party notice now points consumers at a different FFmpeg artifact than the one actually downloaded, so please update the notice alongside the manifest change.

Useful? React with 👍 / 👎.