fix: add fail-closed M5 eight-cell stability profile

[tcconnally]

Summary

• auto-enable a narrow stability profile only for exactly eight cells on a <=20 GiB macOS host
• disable live HLS transcoding for that measured hardware shape
• fail closed before playback by admitting only resources with complete metadata at <=30 fps and <=20 Mbps
• keep the existing software decoder and 256 MiB/cell, 2 GiB aggregate cache profile
• retain explicit on/off and limit overrides; all other platforms and cell counts keep existing behavior

Evidence boundary

This responds to the completed M5 soak series:

• direct heterogeneous playback was transport-clean but still froze
• 30 fps / 25 Mbps runtime shaping caused 1,314 HLS segment failures and hundreds of Emby 404/500 responses
• therefore this change does not retry the failed live-transcode architecture; it creates a direct-only safe subset before libmpv opens media

This is the final code-side stability attempt before development pauses. Native M5 soak evidence is still required after merge; the PR does not claim the freezes are eliminated.

TDD and verification

• RED: missing profile selector, stable-candidate predicate, pool filter, wall wiring, and safe diagnostic metadata all failed first
• python3 tests/run_all.py — OVERALL PASS
• python3 -m compileall -q hyperwall tests scripts — PASS
• bash -n soak_wall.sh — PASS
• git diff --check — PASS
• added-lines security scan — no secret, shell injection, eval/exec, or pickle findings

Runtime behavior on the target

The startup log will report both:

• Stable direct-only profile: ...
• Stable direct-only pool: admitted N/M items ...

Use HYPERWALL_STABLE_DIRECT_ONLY=0 as the rollback switch.