fix(skills): honor offline TTS with expired HeyGen auth

[miguel-heygen]

What

• Treat expired HeyGen OAuth as unavailable instead of eagerly throwing before provider selection.
• Let the faceless-explainer adapter honor --provider and HF_TTS_PROVIDER, with the CLI flag taking precedence.
• Document explicit provider selection in the faceless workflow.

Why

A user explicitly selecting local Kokoro still hit heygenAuthHeaders() during shared audio-engine startup. An expired OAuth credential therefore aborted the run before the engine could honor the offline provider.

Reproduction

Confirmed against current main with an expired OAuth credentials file and an audio_request.json selecting Kokoro: the shared engine exited at startup with HeyGen OAuth token expired. The same reproduction exits successfully after this change.

Tests

• Expired OAuth is not reported as an available HeyGen TTS provider.
• Explicit Kokoro bypasses expired HeyGen auth in the shared engine.
• Faceless adapter covers CLI flag passthrough, env fallback, and flag precedence.
• bun run test:skills (234 passed)
• bun run lint:skills
• targeted oxfmt --check
• git diff --check

[miguel-heygen]

Consolidated with the related TTS provider and error-handling fixes in #2407. The still-relevant behavior from the retired skill path is ported into media-use with regression coverage.