Harden yt-dlp binary resolution and analysis subprocess handling

- get_yt_dlp_path() no longer implicitly executes a bare "yt-dlp" from
  PATH (on Windows that lookup includes the CWD, so a planted binary
  in a writable directory could be run). A system yt-dlp is used only
  behind the explicit advanced.allow_system_ytdlp config opt-in, and
  then always as a which()-resolved absolute path. Analysis and
  download refuse to exec the not-installed sentinel.
- Analysis subprocesses now run in their own session and the whole
  process group is killed on timeout, so deno grandchildren no longer
  leak; partial stderr is preserved and logged, and output decoding is
  pinned to utf-8 with replacement (Windows locale codecs crashed on
  non-UTF8 titles).
- Flat-playlist entries are filtered for None (private/deleted first
  video no longer breaks analysis).
- update_yt_dlp() normalizes the sentinel to Path, unbreaking the pip
  fallback path that crashed on str.exists().

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ytsage/core/ytsage_utils.py

@@ -432,8 +432,9 @@ def save_path(main_window_instance: Any, path: Union[str, Path]) -> bool:
 def update_yt_dlp() -> bool:
     """Check for yt-dlp updates and update if a newer version is available."""
     try:
-        # Get the yt-dlp path
-        yt_dlp_path: Path = get_yt_dlp_path()
+        # Get the yt-dlp path (may be the bare "yt-dlp" sentinel string when
+        # not installed - normalize to Path so .exists()/.samefile() work)
+        yt_dlp_path: Path = Path(get_yt_dlp_path())
 
         # Extra logic moved to src\utils\ytsage_constants.py