[Linuxuser67]

Two commits, both from the whole-state review:

Batch 2 hardening:

• Escape duration_string in the Pango-markup group description (Escape Pango markup in video preview header #65 missed it).
• Cookie export temp file created atomically (create_new + 0o600 from birth); pre-planted symlinks fail instead of diverting the dump.
• ensure_staging_dir helper: create + canonicalize + verify-under-root at both staging call sites; clean_staging guard canonicalized too. 2 new tests (roundtrip, symlink-escape rejection).

Indeterminate everywhere (follow-up to #72):

• Every engine spawn (direct, torrent, video) resets row progress to 0. Retried/resumed rows carried stale fractions, which froze as determinate bars through "Resolving media…" / "Connecting…" — the indeterminate rule only applied to fresh rows. Queued resume-point display is untouched (reset happens at spawn, not on retry). Engines derive resume state from files, never the row, so nothing functional changes.

236 passing, clippy/fmt clean.