Disable browser cookie fallback for local X auth

Prefer injected AUTH_TOKEN/CT0 for bundled Bird, disable browser-cookie probing in repo-invoked subprocesses, and keep repo-invoked yt-dlp from inheriting browser-cookie settings.

Validation: uv run python -m unittest tests.test_bird_x tests.test_youtube_yt

tests/test_youtube_yt.py

@@ -0,0 +1,49 @@
+"""Tests for yt-dlp invocation safety flags."""
+
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).parent.parent / "scripts"))
+
+from lib import youtube_yt
+
+
+class _DummyProc:
+    def __init__(self):
+        self.pid = 12345
+        self.returncode = 0
+
+    def communicate(self, timeout=None):
+        return "", ""
+
+    def wait(self, timeout=None):
+        return 0
+
+
+class TestYtDlpFlags(unittest.TestCase):
+    def test_search_ignores_global_config_and_browser_cookies(self):
+        proc = _DummyProc()
+        with mock.patch.object(youtube_yt, "is_ytdlp_installed", return_value=True), \
+             mock.patch.object(youtube_yt.subprocess, "Popen", return_value=proc) as popen_mock:
+            youtube_yt.search_youtube("Claude Code", "2026-02-01", "2026-03-01")
+
+        cmd = popen_mock.call_args.args[0]
+        self.assertIn("--ignore-config", cmd)
+        self.assertIn("--no-cookies-from-browser", cmd)
+
+    def test_transcript_fetch_ignores_global_config_and_browser_cookies(self):
+        proc = _DummyProc()
+        with tempfile.TemporaryDirectory() as temp_dir, \
+             mock.patch.object(youtube_yt.subprocess, "Popen", return_value=proc) as popen_mock:
+            youtube_yt.fetch_transcript("abc123", temp_dir)
+
+        cmd = popen_mock.call_args.args[0]
+        self.assertIn("--ignore-config", cmd)
+        self.assertIn("--no-cookies-from-browser", cmd)
+
+
+if __name__ == "__main__":
+    unittest.main()