fix(filebot): reject wrong-year movie matches and email unprocessed downloads

[twistedmelonman]

Summary

Fixes #216: non-strict TheMovieDB filed the 1989 NBC miniseries Around the World in 80 Days as the 1988 animated film after strict auto-detection had refused it.

Year guard. Before TheMovieDB or OMDb move anything, process_with_database dry-runs the match. filebot_year_mismatch compares each destination's (YYYY) with the years in the source filename (or its folder name). The preview runs the same check. On a mismatch:

• nothing moves, and the database chain stops (filebot_chain_should_stop)
• a YEAR MISMATCH: line makes classify_failure return no-match, ahead of any conflict line, so a wrong-title duplicate never reaches media-compare
• a dry run with no match lines also moves nothing (fail closed)

Exact match only. A one-year tolerance would not have caught 1989 → 1988, so a correct match whose TMDB year is one off the release name now goes to triage with an email. A filename with no year is not checked, and TV databases are not guarded.

Email. A download triaged as no-match or failed sends one email to alerts.email from config.yml, through alert-lib.sh. It names the torrent, the triage folder and the reason. already-in-plex sends nothing. The email goes out after the triage move, so watcher retries do not resend it. CR/LF in the torrent name are stripped from the subject. transmission-filebot-setup.sh writes alerts.email from MONITORING_EMAIL.

Deployment

Live transmission-done is a symlink into the main checkout, so the code goes live when main is pulled there. No email is sent until the live config.yml has an alerts.email key. It is not there today. Add it by hand or re-run setup.

Testing

• 528 BATS tests pass locally (full suite; this repo has no CI test job)
• The new tests were checked against the code with each fix removed: the guard, fail-closed and header-injection tests fail without them
• shellcheck and shfmt are clean on both scripts

Review notes

The pre-push review warned that dry_run=$(run_filebot ...) could abort under errexit. The script runs set -uo pipefail without -e (line 25), and the real-run assignment next to it uses the same pattern, so no change was made.