fix(models): close mmproj integrity gaps (catch-up move + size floor)

[fl4p]

Follow-up to #18. A post-merge adversarial review found two real defects in the mmproj GGUF integrity validation that shipped with #18.

Bugs

1. Catch-up guard kept corrupt sidecars. The mmproj sidecar can complete natively before the onComplete listener registers, so there's a "catch-up guard" path. On move-failure that path only checked RNFS.exists(target) — if a corrupt-but-present file sat at the target it was silently kept as the vision projector. The onComplete handler already validated properly; only the catch-up path was missed. Both paths now share reconcileMmProjMoveFailure() (read-only validate → reuse if valid, downgrade to text-only if not, never delete), so they can't drift again.

2. Size check bypassed when expected size is unknown. mmProjFileValid/checkMmProjExists only compared size if (expectedSize). On crash-restore the reconstructed download can have mmProjFileSize = 0/undefined, so the size check was skipped and a 0-byte/truncated stub with an inconclusive magic read passed as valid. Added an absolute MIN_MMPROJ_FILE_SIZE (1 KB) floor independent of expectedSize, mirroring the existing MIN_GGUF_FILE_SIZE floor in llmSafetyChecks.

Tests

• catch-up path now downgrades-without-deleting when the present target is corrupt (bad GGUF magic)
• catch-up path rejects a sub-1KB stub when expectedSize is unknown
• Full modelManager + parallelMmproj + integration/models suites pass (343 tests); tsc and lint clean.