#3 feat: adopt typed yt-dlp broker and reproducible CI

Summary

• migrate all yt-dlp calls to the typed run_ytdlp host contract
• remove plugin-controlled binaries, arguments and timeout values
• add full WASM ABI smoke coverage and pinned reproducible CI
• use upstream Extism 1.30.0 and stop tracking the generated WASM binary

Validation

• 106 unit tests and 3 WASM smokes pass
• native and WASM Clippy pass with warnings denied
• release WASM build and cargo audit pass

Linear: MAT-129, MAT-131

---

Summary by cubic

Migrates all yt-dlp calls to the typed run_ytdlp broker to harden security and make behavior consistent across hosts. Adds WASM ABI smoke tests and reproducible, pinned CI (repinned reusable workflows); updates extism to 1.30.0; stops tracking the built WASM; and restricts releases to the repo owner. Linear: MAT-129, MAT-131.

• New Features

  • Switched to the typed run_ytdlp host API; the host now owns the binary, args, timeouts, env, and cwd.
  • Added WASM ABI smoke tests and reproducible CI with a pinned Rust toolchain; split verification and release workflows, pinned canonical reusable workflows by SHA (repinned), and limited tag releases to the repository owner.
  • Updated to extism 1.30.0 and removed the tracked vortex_mod_youtube.wasm.

• Migration

  • Requires Vortex host >= 0.2.0 (min_vortex_version updated).
  • Host must provide run_ytdlp and manage yt-dlp; install yt-dlp in a host-approved path.
  • Plugin install path updated to ~/.local/share/dev.vortex.app/plugins/... as shown in the README.