Plex corpus: fail closed on exact item and media source identity - #310

Scope

Fixes #309. Plex debug playback probes bind fresh metadata to an exact title, ratingKey, Media ID and single Part ID, resolving the current media index rather than selecting version zero. Missing, mismatched, duplicate and multipart sources fail closed before playback.

Read-only discovery hydrates at most five unique exact-title hits into a private app-container file; runners must check freshness and match paths/sizes against their private inventory. The opt-in mobile Plex Link test uses ordinary browser authorization, never token injection.

Rebased directly onto current main (ba427332), excluding already-squashed PR306 history and preserving merged Emby identity tests and condensed corpus/auth guidance. Five-file harness/docs scope; no production decoder, HDR, Plex profile, or infrastructure changes.

Validation on this rebased PR alone

• Full hermetic PMSKit suite: 1,705 tests passed; hygiene, strict MkDocs, links and Mermaid checks passed.
• Fresh iPhone build, hosted tests and semantic fixture-detail smoke passed; ordinary Plex Link authentication passed.
• Restored-session live alternate-source playback resolved media index 1, with server-decision video/audio copy and reviewed nonblack initial/post-hold frames.
• Wrong Media ID, Part ID and title each produced a fresh blocked report, no new playback session and no fresh frames. Pure tests additionally cover wrong item identity, reordered versions, duplicates, missing media/parts and multipart rejection.
• Fresh native visionOS, tvOS and isolated macOS builds and visually reviewed fixture smokes passed. Simulator executable/debug-library hashes matched the fresh products. Owned simulators and staged Mac apps removed; final read-only Plex Transcoder count was zero.

Limits and follow-up

The later 27-report corpus stack audit is historical dependent-stack evidence, not validation of PR310 alone. PR313 evidence-provenance and PR314 track-transition changes are separate, unchanged and not included here. Whole-file Direct Play, broad codec/seek coverage and physical-device display/audio/HDR acceptance are not established by this bounded revalidation. All source bindings, paths, frames and raw logs remain private and gitignored.

Awaiting parent review and exact-head merge approval; do not merge automatically.