chore(deps): refresh packages and bundled engines

- update compatible npm and Cargo lock dependencies
- refresh yt-dlp and target-specific FFmpeg artifacts with verified hashes
- detect provider SHA-256 drift in the update checker

scripts/check-updates.node-test.js

@@ -65,3 +65,23 @@ test('checkRows does not fall back to the generic release for target-specific en
     /Latest provider version is unavailable for test-target ffmpeg/
   );
 });
+
+test('checkRows detects a provider hash change when version and URL are current', () => {
+  const outdated = checkRows(
+    [{
+      target: 'test-target',
+      engine: 'test-engine',
+      version: '1.0.0',
+      url: 'https://example.test/engine',
+      sha256: 'a'.repeat(64),
+    }],
+    { 'test-engine': '1.0.0' },
+    {},
+    {},
+    new Set(),
+    {},
+    { 'https://example.test/engine': 'b'.repeat(64) },
+  );
+
+  assert.equal(outdated, 1);
+});