Truncated ffprobe output is read as a malformed file, permanently

An ordinary upload can make a valid media file permanently unanalyzable. `Ffprobe#perform` asks for `-show_format -show_streams` including arbitrary tags, `run_tool` keeps only the first 64 KiB of stdout and says nothing about having truncated it, and parsing that incomplete prefix raises `JSON::ParserError`, which the analyzer turns into a permanent unreadable verdict.

The assessment generated a valid 70,917-byte MKV with a large metadata tag. Unrestricted `ffprobe` produced 72,182 bytes of valid JSON; the captured 65,536-byte prefix was invalid JSON; the real operation returned a permanent unreadable result. Active Storage never revisits a permanent verdict, so the blob stays unanalyzed and any application logic keyed on duration, dimensions, or audio/video presence acts on missing metadata.

The root error is treating known-truncated output as complete, and then as evidence that the *input* is malformed. Truncation is our bound, not a property of the file.

## Fix direction

- Request only the fields we consume with `-show_entries`, plus the minimal rotation side data. We discard the arbitrary tags anyway.
- Make bounded capture return an explicit truncated bit, and never parse a known-truncated body as structured output.
- Never map truncation to a permanent verdict.

Acceptance: analyze a fixture whose unrestricted `ffprobe` output exceeds 64 KiB and require complete expected metadata, without raising and without `{}`.

## Why this one is filed despite #28

Mike deprioritised the permanent-unprocessable-verdict class on 2026-08-24: HotCell exists to protect the application from image processing, and one worker corrupting another's verdict is secondary. This finding is in that class but is not reached that way — no compromise, no sibling, no signal. A customer uploads a file with verbose metadata and it is permanently condemned. That is why it is worth doing on its own.

`HC-PT-004` of the purple-team assessment of 2026-08-22, rated Medium correctness. Related: #28, #6.

Start by reading Ffprobe#perform and run_tool to trace the bounded stdout capture through JSON parsing and the analyzer verdict. Add a regression fixture whose unrestricted ffprobe output exceeds 64 KiB, then run the relevant analyzer tests; done means expected metadata is complete, parsing does not raise, and truncation is not treated as a permanent unreadable result.

Written by the indexing model from the issue text.