Sniff Windows executables (MZ with its PE header)

For the junk judge: a "movie" whose first bytes are a program is fake.
Two bytes alone match random data too often, so the PE signature where the
DOS header points must be there too. No PROBE_VERSION bump: new probes only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/content/sniff.ts

@@ -33,6 +33,8 @@ export type ContentType =
   | 'wav'
   | 'ogg'
   | 'bzip2'
+  /** A Windows executable (MZ with its PE header): a "movie" that is a program is fake (app/services/release_judge.ts). */
+  | 'exe'
 
 /** Magic bytes at an offset; null matches any byte. */
 const SIGNATURES: [ContentType, number, (number | null)[]][] = [
@@ -75,6 +77,11 @@ export function sniffContentType(data: Buffer): ContentType | null {
     if (form === 'AVI ') return 'avi'
     if (form === 'WAVE') return 'wav'
   }
+  // MZ, and "PE\0\0" where the DOS header points (e_lfanew at 0x3c): two bytes alone match random data too often.
+  if (data.length >= 0x40 && data[0] === 0x4d && data[1] === 0x5a) {
+    const pe = data.readUInt32LE(0x3c)
+    if (pe + 4 <= data.length && data.readUInt32BE(pe) === 0x50450000) return 'exe'
+  }
   const head = data.subarray(0, 512).toString('latin1')
   if (/^\s*(<\?xml[^>]*>\s*)?(<!DOCTYPE nzb|<nzb[\s>])/.test(head)) return 'nzb'
   return null