fix(selfcheck): P0-4 check reports "VULNERABLE" when ffmpegthumbnailer is absent

[nocstah]

The thumbnail-video.sh symlink regression check fails on any machine without
ffmpegthumbnailer, and reports it as a security failure:

[FAIL] thumbnail-video.sh: pre-planted dangling symlink at dest is not
followed (P0-4 regression) — VULNERABLE: dest still a symlink=false
victim target created=false

Both values printed there are the SAFE ones. The actual cause is the third
term, which the message does not print:

var safe = !stillSymlink && !victimCreated && destIsRegular

destIsRegular can only be true if a thumbnail was really written, which needs
ffmpegthumbnailer -- an optional dependency per the README. Without it the
script correctly destroys the planted symlink and exits without writing, so
the host is safe, and the suite calls it VULNERABLE anyway. On a fresh clone
here that is the only failing check out of 125.

This splits the security assertion from the functional one:

• !stillSymlink && !victimCreated -- the P0-4 property, asserted always.
• destIsRegular -- only required when ffmpegthumbnailer
  is actually installed.

and adds destIsRegular to the failure message so a future failure says which
term broke. When the tool is missing the check passes with an explicit note
that thumbnail writing was not exercised, rather than silently implying full
coverage.

Verified both directions on a host WITHOUT ffmpegthumbnailer:

• unmodified script -> PASS, "symlink safety verified (planted link
  destroyed, target never created); thumbnail write not exercised --
  ffmpegthumbnailer not installed"
• script temporarily replaced with a deliberately vulnerable stand-in that
  writes through the planted symlink -> FAIL, "VULNERABLE: dest still a
  symlink=true victim target created=true dest is a regular file=true"

so the security property is still enforced on hosts that cannot run the
thumbnailer; it is only the functional half that is now conditional.