feat(core): verify output integrity before replacing original

After ffmpeg exits successfully, run ffprobe against the temporary
output file to confirm it is a valid, playable media file before
replacing the original. If the probe fails the temporary file is removed
and the encode is treated as a runtime failure, leaving the original
untouched.

This guards against cases where ffmpeg exits 0 but has written a
truncated or corrupt container (e.g. due to a disk-full condition
mid-write, a codec bug, or a preset producing an unreadable stream).

The check is enabled by default and can be disabled via
--no-verify-output or [encoding] verify_output = false in config.toml
for large batch jobs on trusted encoders where the extra ffprobe
  round-trip is undesirable.

The --continue flag is honoured: a failed integrity check counts as a
runtime failure for the purposes of deciding whether to proceed to the
next file.

Docs, man page, bash completion, and README updated accordingly.

1 files changed, 25 insertions, 2 deletions

diff --git a/transcode.sh.1 b/transcode.sh.1
index 9a4c894..92cefa2 100644
--- a/transcode.sh.1
+++ b/transcode.sh.1
@@ -34,8 +34,12 @@ default (\fB\-map 0 \-map_metadata 0 \-map_chapters 0 \-c copy\fR); the
 preset only needs to override the streams it cares about (typically
 video).
 .PP
-Encoding is performed into a temporary file in the same directory as the
-input, which ensures an atomic rename on completion.
+After encoding completes,
+.BR ffprobe (1)
+is run against the temporary output file to verify it is a valid,
+playable media file before the original is replaced. If the integrity
+check fails the temporary file is removed and the encode is treated as a
+runtime failure, leaving the original untouched.
 .SH OPTIONS
 .TP
 .BR \-c ", " \-\-continue
@@ -49,6 +53,19 @@ Do not continue processing next file even if
 .BR ffmpeg (1)
 fails on the current one.
 .TP
+.BR \-\-verify\-output
+After encoding, probe the temporary output file with
+.BR ffprobe (1)
+to confirm it is a valid, playable media file before replacing the
+original. Enabled by default.
+.TP
+.BR \-\-no\-verify\-output
+Skip the post-encode integrity check. The original is replaced as long
+as
+.BR ffmpeg (1)
+exits successfully. Useful for large batch jobs on trusted encoders
+where the additional probe round-trip is undesirable.
+.TP
 .BR \-\-config\-file " \fIPATH\fR, " \-\-config\-file= \fIPATH\fR
 Load configuration from \fIPATH\fR instead of the default location
 .RI ( ${XDG_CONFIG_HOME:-$HOME/.config}/transcode.sh/config.toml ).
@@ -270,6 +287,12 @@ String. Default preset name. Equivalent to
 Integer. Default niceness value. Equivalent to
 .BR \-N .
 .TP
+.B [encoding] verify_output
+Boolean. Equivalent to
+.BR \-\-verify\-output / \-\-no\-verify\-output .
+Defaults to
+.BR true .
+.TP
 .B [skip] codecs
 Array of strings. Merged with any codecs from
 .BR \-S .