feat(ytdlp)!: drop the bundled yt-dlp download, resolve from PATH

[cmglezpdev]

What

youtube-dl-exec was a dependency veta never imported, declared purely so its postinstall would drop a yt-dlp copy that binary.ts used as a third resolution source. It's gone. Resolution is now VETA_YTDLP_PATH → PATH, and bundledPath() plus the "bundled" BinarySource are deleted.

This implements the preferred fix from review/HIGH/R-012.

Why

The bundled copy cost far more than it was worth:

• Unpinned and unverified. The postinstall fetched whatever releases/latest served on install day, with no version pin and no checksum. Every user ran a different, unauditable binary.
• Install-time network dependency. npm install -g @cmglezpdev/veta failed outright when the GitHub API was unreachable or rate-limited. Both workflows had to set YOUTUBE_DL_SKIP_DOWNLOAD to survive the 60-requests-per-hour anonymous limit on shared runner egress — it took out macOS the first time CI ran.
• Python, twice. Its preinstall refused to install without Python >= 3.9, and the asset it dropped was a Python zipapp, so the bundled fallback needed a Python interpreter at run time too. PRD NFR-1 claimed the opposite on both counts.
• Weight. Roughly 40 of the ~55 production packages existed to support that one postinstall.
• npm is closing this door. Installing veta now warns 1 package has install scripts not yet covered by allowScripts. No package-side change can suppress it — I verified that a paste of allowScripts into veta's own package.json does not propagate to consumers; only the installing project's package.json counts. That warning was headed for every veta user, and eventually becomes a block.

Error message

YTDLP_NOT_FOUND told users to "reinstall with pnpm" — the one package manager that skips dependency build scripts by default, so the advice could never work — and to set a ytDlpPath config key that has never existed. It now names brew install yt-dlp, pipx install yt-dlp and VETA_YTDLP_PATH.

Tests

The YTDLP_NOT_FOUND test only reached that error by accident: with an empty PATH, the zipapp's #!/usr/bin/env python3 shebang failed. On Windows (yt-dlp.exe), or any setup where the bundled probe succeeded, it would have resolved source: "bundled" instead of rejecting. With no bundled source the case is deterministic. Two missing cases are now covered: plain PATH resolution, and falling back to PATH when the configured path is unusable.

Verified

before:  59 packages + allow-scripts warning
after:   16 packages, no youtube-dl-exec warning
         veta doctor → source: path, version: 2026.07.04

pnpm typecheck clean; 603 tests pass, 1 skipped.

Docs

PRD goal 4, NFR-1, FR-24 and the technology table all described the automatic-download, no-Python story — wrong on both counts, all four corrected. docs/06-development.md now records why the binary must not come back, so nobody reintroduces it. pnpm-workspace.yaml is deleted: its only content was the allowBuilds approval for the removed package.

Breaking

veta no longer ships or downloads a yt-dlp binary. Users without yt-dlp on PATH must install it or set VETA_YTDLP_PATH. The README's quick path already led with that install.