fix: deterministic resource selection for decoder qualification

[tcconnally]

Summary

• add deterministic --item-id selection for controlled VideoToolbox resource phases
• apply exact selection against the full Emby response, so direct-only filtering cannot hide the requested item
• fail closed for missing or ambiguous IDs
• record the selected resource in the private phase manifest without credentials or source URLs
• add launcher cleanup, focused tests, and operator documentation

Verification

• python3 tests/run_all.py — OVERALL: PASS (all suites green)
• candidate commit: f4132740a4b7ab1c2552614d894a8e1b1a9b1ad1
• binary diff SHA-256 from main 074258ddb6b1b2e3e1e8bd5cbe09742310c5d99b: 0de5b16a9c020acb76ccc571f5b3941911b4a46507c788615a2e9196a0109b7f

Acceptance boundary

This resolves the deterministic harness gap for #78. It does not claim native VideoToolbox qualification: the known-good and malformed-resource Mac phases still need to run on the target Mac with current per-resource decoder telemetry and media gates. The target host was unavailable from the current Linux environment, so no native result is fabricated.

Addresses #78