Fix Windows active timeline writes, compile metadata, and fixture redaction

[renezander030]

CapCut 8.7.0 on Windows loads an existing project's selected nested timeline, while the CLI previously edited only the root mirrors. Those edits disappeared when the app reopened or closed the project. The supplied field fixture now drives active-timeline selection and regression coverage.

This patch also fixes two independent pipeline defects: compile's ratio-only canvas override and source-duration metadata (#133), and fixture redaction of JSON-escaped Windows home paths (#134).

Changes

• Follow a validated active pointer on the evidenced Windows 8.7.0 layout; synchronize only that timeline, its readable documents, and readable root mirrors through the existing transactional writer. Preserve document IDs, envelopes, other timelines, and project-root asset/metadata locations. Check the pointer and target containment again before writing. Other versions and OSes retain prior selection behavior.
• Use active → root for sync on that layout, including with --nested. Existing root-only edits appear as divergence; the plan retains the newer-mirror refusal rather than silently choosing newer roots.
• Resolve compile's canvas through the init/quickstart resolver for both --check and actual writes. Separate full probed video/audio duration from segment duration in materials and sidecar entries. Validate speed-adjusted source ranges before initialization. Without probe evidence, an explicit duration supplies a lower bound covering the requested source range.
• Redact escaped Windows paths, including embedded JSON strings. Run residual-value verification on every new bundle, persist its result, and fail the CLI when findings remain. Scan every home path on a line, including short and Unicode account names.
• Commit the supplied fixture with provenance, update the command reference, changelog, and English/Chinese support notes, and add an end-to-end review guide.

Validation

• npm test: 1,017 tests passed, zero failures or skips on Node 22.22.0.
• npm run lint, npm run docs:commands, and git diff --check passed.
• GitHub CI passed on Node 18/20/22 and Windows/macOS/Ubuntu; lint and the Wasm component checks passed too.
• Regression coverage includes the reported root/nested divergence, preserved archived timelines and IDs, JSON envelopes, pointer changes, symlink containment, repeated saves, asset/sidecar locations, restore, cross-version last-modified markers, portrait canvases, nonzero cuts and full duration metadata, and automatic redaction failure.

The subprocess sandbox times out on the existing compile stdin test even on untouched master. The complete suite passes when run outside that sandbox.

Desktop verification

The field fixture establishes on-disk shape and divergence. The reporter observed nested content winning in CapCut 8.7.0.3685 on Windows; the patched CLI still needs an app open/close round-trip. Follow the review guide for caption survival, media staging, restore, compile cuts, and fixture redaction.

Keep #50 open until that round-trip passes. The 7.x and Mac 9.2.8-beta4 reports remain separately unverified. This PR prepares the patch for review; it does not publish a release.

Fixes #133.
Fixes #134.
Refs #50.