fix: enable yt-dlp EJS solver so YouTube formats resolve

YouTube gates media formats behind signature / "n" JS challenges that
yt-dlp's bundled solver can't reliably crack. Without the EJS
remote-component solver script yt-dlp warns "Signature/n challenge
solving failed: Some formats may be missing" and downloads break — even
with valid cookies, so it masquerades as a cookie/auth problem.

Pass --remote-components ejs:github by default (env/CLI overridable) on
all four yt-dlp call sites. Needs a recent yt-dlp + deno present; set
YTDLP_REMOTE_COMPONENTS / --remote-components '' to disable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_repair.py

@@ -401,6 +401,28 @@ def test_metadata_fetch_passes_cookies(monkeypatch):
     assert "/cookies.txt" in captured["cmd"]
 
 
+def test_ejs_args_default(monkeypatch):
+    monkeypatch.setattr(mf, "REMOTE_COMPONENTS", "ejs:github")
+    assert mf._ejs_args() == ["--remote-components", "ejs:github"]
+
+
+def test_ejs_args_disabled(monkeypatch):
+    monkeypatch.setattr(mf, "REMOTE_COMPONENTS", "")
+    assert mf._ejs_args() == []
+
+
+def test_metadata_fetch_passes_ejs(monkeypatch):
+    captured = {}
+
+    class _R:
+        stdout = '{"title": "x"}'
+    monkeypatch.setattr(mf, "REMOTE_COMPONENTS", "ejs:github")
+    monkeypatch.setattr(mf.subprocess, "run", lambda cmd, **k: captured.update(cmd=cmd) or _R())
+    mf.run_yt_dlp_get_metadata("http://u")
+    assert "--remote-components" in captured["cmd"]
+    assert "ejs:github" in captured["cmd"]
+
+
 def test_metadata_fetch_logs_stderr(monkeypatch, capsys):
     def boom(cmd, **k):
         raise mf.subprocess.CalledProcessError(