test(hls): [PKG-HLS-02] cover released contracts and real SDK playback

refactor/third-party.json

@@ -1023,7 +1023,8 @@
       "id": "hls.js",
       "riskId": "SDK-01",
       "owners": [
-        "PKG-HLS-01",
+        "PKG-HLS-03",
+        "PKG-HLS-05",
         "EX-03"
       ],
       "sourceFiles": [
@@ -1031,7 +1032,7 @@
         "docs/assets/example/hls.control.js"
       ],
       "contract": "Caller supplies art.hls; homepage demo loads hls.js 1.5.17. Preserve quality/audio selectors and old core integration.",
-      "validationStatus": "Source integration observed; complete real SDK/service/device matrix not yet verified.",
+      "validationStatus": "Hls.js 1.5.17 frozen in refactor/baselines/hls-sdk.json; Chromium/Firefox local playback baseline verified in PKG-HLS-02. Windows WebKit has no MSE; Safari/native/worker/version and installed-package matrices remain open. See refactor/hls-validation.md.",
       "demoPathsSource": "refactor/baselines/demo-inventory.json"
     },
     {