Sniff Windows executables (MZ with its PE header)

For the junk judge: a "movie" whose first bytes are a program is fake.
Two bytes alone match random data too often, so the PE signature where the
DOS header points must be there too. No PROBE_VERSION bump: new probes only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/content/sniff.spec.ts

@@ -0,0 +1,20 @@
+import { test } from '@japa/runner'
+import { sniffContentType } from '#lib/content/sniff'
+
+test.group('content / sniff', () => {
+  test('a Windows executable: MZ with a PE header where the DOS header points', ({ assert }) => {
+    const exe = Buffer.alloc(0x100)
+    exe.write('MZ', 0, 'latin1')
+    exe.writeUInt32LE(0x80, 0x3c)
+    exe.write('PE\0\0', 0x80, 'latin1')
+    assert.equal(sniffContentType(exe), 'exe')
+    // MZ alone (random data, a text) is no executable.
+    const mz = Buffer.alloc(0x100)
+    mz.write('MZ', 0, 'latin1')
+    assert.isNull(sniffContentType(mz))
+    // A pointer past the data: none.
+    mz.writeUInt32LE(0xffff, 0x3c)
+    assert.isNull(sniffContentType(mz))
+    assert.equal(sniffContentType(Buffer.from([0x1a, 0x45, 0xdf, 0xa3, 0, 0, 0, 0])), 'matroska')
+  })
+})