fix(tools): verify pinned archives before atomic install

Pin Streamlink and FFmpeg archives to verified manifests, stage replacements before promotion, and expose managed tool status with repair and reset controls. Keep updater checks exclusive until their underlying operation settles and restore default electron-builder certificate environment support.

src/preload.ts

@@ -200,6 +200,9 @@ contextBridge.exposeInMainWorld('api', {
     installUpdate: () => ipcRenderer.invoke('install-update'),
     openExternal: (url: string) => ipcRenderer.invoke('open-external', url),
     runPreflight: (autoFix: boolean) => ipcRenderer.invoke('run-preflight', autoFix),
+    getManagedToolStatus: () => ipcRenderer.invoke('get-managed-tool-status'),
+    repairManagedTools: () => ipcRenderer.invoke('repair-managed-tools'),
+    resetManagedTools: () => ipcRenderer.invoke('reset-managed-tools'),
     getDebugLog: (lines: number) => ipcRenderer.invoke('get-debug-log', lines),
     getRuntimeMetrics: (): Promise<RuntimeMetricsSnapshot> => ipcRenderer.invoke('get-runtime-metrics'),
     exportRuntimeMetrics: (): Promise<{ success: boolean; cancelled?: boolean; error?: string; filePath?: string }> =>