ci(review): install ffmpeg for video proof inspection

[Takhoffman]

Summary

• add a shared setup-media-proof-tools action that ensures ffmpeg and ffprobe are available
• run it in both exact event re-review and review shard jobs before video proof inspection
• fail fast on non-apt runners that do not already provide ffmpeg/ffprobe, instead of silently producing ENOENT media artifacts

Validation

• pnpm run check:active-surface
• pnpm exec oxfmt --check .github/workflows/sweep.yml .github/actions/setup-media-proof-tools/action.yml
• pnpm run check

Root cause

The ffmpeg video proof code was deployed, but GitHub review runners did not install ffprobe/ffmpeg before ClawSweeper prepared video proof artifacts, so media extraction reported spawnSync ffprobe ENOENT.