Strengthen the test suite: 298 → 365 tests

[danielchalmers]

A review pass over the whole suite for coverage gaps, redundancy, brittleness, and maintainability. Test-only — the three production bugs this review turned up, and the CI changes, are in #73 on top of this.

The suite was already in good shape — fast, deterministic, no external dependencies, thoughtful fixtures — so this preserves those properties and targets the weaknesses that were actually concentrated somewhere. 365 tests, still ~3s, green in Debug and Release, stable over repeated runs.

Coverage gaps closed

Several surfaces weren't merely untested, they were unreachable — mostly for want of a small seam the codebase already uses elsewhere (clipLoader, backgroundYield, savePathPicker).

Surface	Was	Now
ClipExporter.ExportAsync	zero tests — needs a real ffmpeg process	optional runFfmpeg delegate; the not-installed and partial-output-cleanup paths covered
PackageManager	no test file at all	ExtractFFmpegBin covered
Converters	4 of 13 tested	13 of 13, including null / wrong-type / ConverterParameter branches
VideoPlayerController transport	Play/Next/Previous/GoToClip never called	covered, plus the open-failure branch and two recovery give-up paths
Deleting the clip that's playing	deadlocked on Dispatcher.Invoke, so all 5 delete tests used a null controller	uiInvoker seam; the real path is now tested
Scan empty/error states, keyboard transport	unreachable	covered (no seam needed — the existing clipLoader was enough)
Mp4DurationReader box parsing	happy path only	truncated moov, size 0 / size 1 forms, largesize nesting
Culture invariance	invisible to every test	new CultureInvarianceTests

That last one is worth calling out: every test runs under the machine's own culture, where invariant and current formats coincide, so no test could detect a dropped InvariantCulture argument. Dropping one silently returns zero clips for ar-SA users (UmAlQura rejects the filename outright) or mis-dates every clip by 543 years under th-TH.

Fixtures and reliability

• TestClipFiles wrote uniform 60s chunks spaced 60s apart. Probed duration and nominal spacing were therefore indistinguishable in every timeline calculation — the running sum, the tail computation, and gap detection were mutually interchangeable. It now takes per-chunk durations, so chunk-offset arithmetic is observable.
• FakeClipMediaSourceBuilder exposed raw Lists that tests indexed while Build() appended from a pool thread. The bookkeeping is now private behind its existing lock and handed out as snapshots.
• FfconcatMediaSourceBuilderTests no longer leaks a playlist file per test into %TEMP%, and CamStorageTests no longer recursively scans the build output directory.

Removed, merged, and fixed

Tests removed or merged for duplicating a sibling's exact code path, and one that asserted System.Text.Json's default behavior rather than ours. Several others passed for the wrong reason and were fixed — notably two ClipPlaylist tests whose central assertions already held before the act ran (MoveTo(0) on an empty playlist is a no-op, so CurrentIndex.ShouldBe(-1) was asserting the constructor).

The three seams

This PR is test-only with one deliberate exception: ClipExporter gains an optional runFfmpeg delegate, MainWindowViewModel gains an optional uiInvoker, and PackageManager.ExtractFFmpegBin goes private → internal. The tests literally cannot compile without them, and each defaults to the existing behavior byte-for-byte, so the app is unchanged.

Deliberately deferred

• CamEvent's two JSON paths disagree on a Z-suffixed timestamp — strict yields Kind=Utc, lenient yields host-local, and which path runs depends on an unrelated field. Latent (Tesla doesn't emit offsets today) but real.
• ClipTimeline.GetPosition/ToAbsolutePosition/GetChunk and CamClip.Summary have no production callers — only tests keep them alive.
• Splitting MainWindowViewModelTests.cs and VideoPlayerControllerTests.cs — better as a pure-movement change that doesn't collide with these additions.
• .ffconcat files still leak into %TEMP% per run from two other test files. The durable fix is an internal PlaylistDirectory override; the app never prunes that directory either.