v2.33.6 — parameter contracts + subprocess hygiene

Internal consolidation: a declarative parameter-contract validator and centralized subprocess hygiene.

• Added src/utils/contracts.py validate(params, rules, invariants) — one validator for required/type/enum/min/max/non-empty/parent-dir-exists plus custom invariants, returning consistent agent-friendly errors with coercion + defaults applied. Replaces scattered hand-written validation.
• Changed export_frame_as_still and set_mark_in_out (clip + timeline) validate through contracts. Behavior preserved (same rejections); mark_in/mark_out coerced to int.
• Added src/utils/proc.py safe_run/safe_popen — subprocess wrappers defaulting stdin to DEVNULL so a child can't consume the MCP stdio protocol stream. Inline Python execution routes through safe_run.

Live-validated on DaVinci Resolve Studio 21.0.0.