feat(subtitles): prepare and commit external selections transactionally

[orut34iop]

An external-subtitle picker currently has to change the active selection before it knows whether a downloaded file can be decoded. Add an opt-in prepare/commit/discard API: prepare a bounded local text sidecar without touching either channel, then synchronously publish the decoded candidate once. A failed preparation leaves the prior selection in place; commit does not reopen the file.

Candidates are bound to an engine, load/stop generation and shared primary/secondary selection intent. A newer selection, clear, removal or successful commit invalidates older candidates. Consumption precedes track-list publication, so a synchronous observer cannot consume the same handle twice. The same registered track can still occupy both channels; no host-specific exclusivity rule is added.

File validation and decoding run on the existing blocking worker. SRT/WebVTT/ASS/SSA input is forced by local extension, with configurable positive file/cue/text limits and no network protocols. Ordinary selection keeps its existing behavior. Prepared registry entries retain their preparation policy for reselection, and ASS uses the existing preserveASSMarkup choice.

Dependency: this branch includes #826 (58cc7eeb45b2f6e3d0bc47f68c1f53285adbfff9) because a prepared secondary ASS selection must publish its script header. After #826 merges, this PR's remaining diff is the transaction API. Other first/second-batch PRs are not included. Existing #239/#267 parsing and style support is reused; downloading and rendering remain host responsibilities.

Tests cover unchanged old selection on failure, owner/discard/duplicate-commit checks, stop/load/selection invalidation, exact registered IDs, shared intent, cancellation, size/cue limits, symlinks, off-main metadata admission, commit after deleting the source file, same-track dual selection and ASS header/style preservation.

Validation on Apple Silicon (Mac17,3), macOS 26.7.1 / Swift 6.4:

• swift build --build-tests passed; valid Apple Development signing/verification for test executables.
• Strict cooperative-pool focused run: 19 tests / 2 suites passed, including real stop() invalidation and the documented default-limit contract.
• Full default-traits suite, serial: 795 XCTest (one pre-existing skip) and 4,633 Swift Testing tests / 635 suites passed.
• Documentation links and git diff --check passed.

Platform/optional-trait validation remains subject to upstream CI. No physical playback/device acceptance is claimed.