fix(video-agent-kit): escape concat input paths

[Ricardo-M-L]

Plugin type (required) / 插件类型（必填）

• UI Plugin / 是 UI 插件 — provides MCP Apps interactive pages / 提供 MCP Apps 交互页面
• Standard plugin / 普通插件（非 UI） — does not provide MCP Apps interactive pages / 不提供 MCP Apps 交互页面
• Not applicable / 不适用 — repository-only changes; no plugin content changed / 仅仓库级改动，不涉及插件内容

Affected plugin name(s) / 涉及的插件名称：video-agent-kit (Standard plugin)

What / 改动内容

FFmpeg concat demuxer list files have their own quoting rules. The plugin previously wrote raw single-quoted paths in eight render and recap paths, so a valid project or media path such as Editor's project/clip.wav was parsed incorrectly and failed with “No such file or directory”.

This change:

• centralizes concat-list serialization in ffproc.py;
• writes absolute POSIX-style paths and escapes literal apostrophes using FFmpeg's concat syntax;
• rejects CR/LF in paths instead of allowing a second directive to be injected;
• migrates all eight concat-list writers to the shared helper;
• adds focused unit coverage plus a real FFmpeg smoke test below an apostrophe-containing directory;
• documents the visible behavior and bumps video-agent-kit from 0.4.3 to 0.4.4 in both manifests and marketplace.json.

No dependency, network, permission, API, or file-write surface is added. The helper only changes serialization of the existing temporary concat-list files. No third-party code or assets are included.

The official plugin currently has a single Chinese README.md and no README_CN.md; this PR updates that existing user-facing document without inventing a large unrelated documentation migration.

Open PR #38 changes Python launcher resolution in the same plugin but does not overlap this runtime fix. It currently reserves version 0.4.5; if it merges first, this branch will be rebased and bumped to the next free plugin version.

Validation

• python3 -m unittest plugins/video-agent-kit/tests/test_ffconcat_paths.py -v — 3 passed, including the real FFmpeg apostrophe-path smoke test.
• python3 -m compileall plugins/video-agent-kit/mcp plugins/video-agent-kit/tests — passed.
• pnpm install --frozen-lockfile — passed.
• pnpm build — passed with Node.js 24.20.0.
• pnpm test — passed (31 root TypeScript tests and all UI-plugin suites).
• python3 -m unittest discover -s tests — 122 passed, 19 skipped.
• python3 scripts/validate.py — 34 plugins validated.
• python3 scripts/build_dist.py — 34 artifacts and 292 assets built.
• git diff --check — passed.

The affected FFmpeg behavior was exercised directly; a full ZCode desktop session was not available.

Self-check / 自查清单

• Plugin name is unique kebab-case; new external plugin directory is external_plugins/<name>/; existing fixes retain ownership / 插件名唯一且 kebab-case，外部新增插件位于 external_plugins/<name>/，已有插件修复保留原归属
• Usage category is set independently of publisher ownership / 用途分类 category 已填写，与维护归属分开
• Plugin type and affected names are declared above / 已在上方声明插件类型与涉及的插件名称
• version bumped in BOTH plugin.json and marketplace.json (artifacts are immutable) / plugin.json 与 marketplace.json 两处版本号已同步升级（制品不可变）
• README.md (EN) and README_CN.md (中文) both updated and equivalent / 中英文 README 均已更新且语义一致 — legacy official plugin has no README_CN.md; its existing README.md was updated
• description_i18n has both en and zh-CN / description_i18n 包含 en 与 zh-CN
• No secrets, machine-specific paths, or private dependencies / 不含密钥、机器专属路径或私有依赖
• Model/API/network dependencies documented / 模型、API、网络依赖已写明
• python3 scripts/validate.py and python3 scripts/build_dist.py pass locally / 本地校验与构建均通过

[panda920]

✅ Internal validation passed. A ZCode maintainer will review the change next; after acceptance, release checks run separately and this PR is closed automatically.