reliability: bound the JS engine + self-heal on player.js rotation

Straw audit 2026-07-04. Three availability defects in the extraction core:

- runtime.rs: cap the embedded QuickJS runtime (64 MiB mem / 2 MiB stack / 5s
  wall-clock interrupt) so a hostile or looping player.js can't hang the
  extraction thread or OOM the process. Previously Runtime::new() set no limits.
- player_manager.rs: replace the never-cleared sticky-error flags with
  invalidate-on-failure. Any deobf/extract error now drops the cached player.js
  so the next call re-fetches fresh and retries, instead of one routine player.js
  rotation permanently wedging ALL extraction until app restart (clear_all_caches
  existed but was never called).
- stream_extractor.rs: per-format graceful degradation. nsig-deobf failure falls
  back to the throttled original URL (YouTube still serves it, rate-limited);
  sig-cipher failure skips just that format. One bad format no longer aborts the
  whole video, and manifests/captions still populate. NPE parity.
- Cargo.toml: release panic=unwind (inert as a straw dep; kept consistent for
  standalone builds/tests).

120 tests pass, clippy clean.

Cargo.toml

@@ -39,7 +39,11 @@ online-tests = []
 strip = true
 lto = "thin"
 codegen-units = 1
-panic = "abort"
+# unwind: inert when built as a dependency of the Straw cdylib (that workspace's
+# profile governs the shipped .so — the load-bearing setting lives in
+# straw/rust/Cargo.toml), but kept consistent so a standalone release build/test
+# of strawcore-core also unwinds instead of aborting on a core panic.
+panic = "unwind"
 opt-level = "z"
 
 [profile.dev]