fix(embedded-mpv): address Greptile/Codex review comments

- Sandbox gate requires a usable helper (Greptile P1, security): the
  main.ts env promotion now also probes for an executable
  iptvnator_mpv_helper before relaxing the window sandbox — a stale
  opt-in on packaged Linux (helper deliberately stripped) or after a
  cleaned native build no longer costs a sandboxless launch for an
  engine that cannot activate. Helper discovery (addon candidate paths +
  X_OK probe) moved into embedded-mpv-frame-copy-platform.util.ts,
  shared by main.ts and the service; the service keeps thin instance
  wrappers so tests can stub per scenario. New util spec pins the
  platform matrix, candidate resolution, and the execute-bit semantics.
- Stale frame-copy artifacts on skipped builds (Codex P2): cleanOutput()
  now also removes iptvnator_mpv_helper and
  embedded_mpv_frame_reader.node, so a failed/skipped rebuild cannot
  leave a previous helper advertising frame-copy support against a
  runtime the build just declared unavailable.
- Multiarch default lib dir (Greptile P1, partially refuted): -l
  resolution never depended on our -L (the compiler's built-in search
  paths include the Debian/Ubuntu multiarch dir — proven by the green CI
  run linking with a nonexistent -L dir), but the system-dev fallback
  now defaults to /usr/lib/<multiarch-triple> when present so the -L
  flag and the helper's baked rpath point somewhere real.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/electron-backend/build-embedded-mpv.js

@@ -182,6 +182,23 @@ function findWindowsLibMpv(runtimeRoot) {
     return null;
 }
 
+/* Debian/Ubuntu install linker targets under the multiarch triple dir. The
+ * compiler's built-in search paths cover it for -l resolution either way;
+ * this keeps the -L flag and the helper's baked rpath pointing somewhere
+ * real. */
+function defaultLinuxSystemLibDir() {
+    const multiarchTriples = {
+        arm: 'arm-linux-gnueabihf',
+        arm64: 'aarch64-linux-gnu',
+        x64: 'x86_64-linux-gnu',
+    };
+    const triple = multiarchTriples[targetArch];
+    if (triple && fs.existsSync(`/usr/lib/${triple}`)) {
+        return `/usr/lib/${triple}`;
+    }
+    return '/usr/lib';
+}
+
 function findLinuxLibMpv(libDir) {
     for (const candidate of ['libmpv.so.2', 'libmpv.so.1', 'libmpv.so']) {
         const candidatePath = path.join(libDir, candidate);
@@ -234,7 +251,9 @@ function resolveRuntime() {
             return {
                 origin: 'system-dev',
                 includeDir: systemIncludeDir,
-                libDir: process.env.LINUX_NATIVE_LIBRARY_DIR || '/usr/lib',
+                libDir:
+                    process.env.LINUX_NATIVE_LIBRARY_DIR ||
+                    defaultLinuxSystemLibDir(),
                 binDir: undefined,
                 manifest: {
                     warning: