reliability+safety: nsig shape fixes, bounded self-heal, no url/id leaks, revived JS tests

- nsig name resolution: route direct-vs-array on capture-group PARTICIPATION,
  not declared-group count (regexes 6/7 carry an optional array group) — a
  direct-call player.js shape no longer hard-fails NsigArrayLookupFailed.
- nsig fixup_function: also strip the `if(typeof X==="undefined")return a;`
  guard on the `function name(a){...}` body shape (previously required a
  leading `;`), so the regex-fallback shape no longer silently yields an
  identity result that gets cached as a permanent throttle.
- player_manager: never hold the state lock across the network; serialize
  player.js downloads behind a fetch gate; add a per-artifact failure memo
  (5-min cooldown) so a persistently-broken player.js costs one refetch per
  open instead of a ~20-25 x 1.7MB storm. Transient-rotation self-heal
  preserved (eval failure -> invalidate + refetch, no memo).
- errors no longer leak watch URLs / video ids: From<reqwest::Error> uses
  without_url(); Recaptcha + link errors reduce to scheme+host (paths like
  /embed/<id> and /shorts/<id> carried the id in the path).
- revive tests/ after the strawcore-core rename; js_phase2_offline green.
  133 lib + 7 integration tests, clippy -D clean.

tests/js_phase2_offline.rs

@@ -14,7 +14,7 @@
 //   * url_with_throttling_parameter_deobfuscated round-trip changes &n=
 //     and caches the result
 
-use strawcore::youtube::js::{signature, nsig, runtime, DeobfError};
+use strawcore_core::youtube::js::{signature, nsig, runtime, DeobfError};
 
 // Synthetic minified player.js — replicates the shape of real YT player.js.
 //