fix: round 2 audit fixes, updated emulator profiles

Scripts:
- fix generate_site nav regex destroying mkdocs.yml content
- fix auto_fetch comma-separated MD5 in find_missing
- fix verify print_platform_result conflating untested/missing
- fix validate_pr path traversal and symlink check
- fix batocera_scraper brace counting and escaped quotes in strings
- fix emudeck_scraper hash search crossing function boundaries
- fix pipeline.py cwd to repo root via Path(__file__)
- normalize SHA1 comparison to lowercase in generate_pack

Emulator profiles:
- emux_gb/nes/sms: reclassify from alias to standalone profiles
- ep128emu: remove .info-only files not referenced in source
- fbalpha2012 variants: full source-verified profiles
- fbneo_cps12: add new profile

scripts/validate_pr.py

@@ -174,14 +174,17 @@ def validate_file(
     else:
         result.add_warning("File not referenced in any platform config - needs manual review")
 
-    if filepath.startswith("bios/"):
-        parts = filepath.split("/")
+    normalized = os.path.normpath(filepath)
+    if os.path.islink(filepath):
+        result.add_check(False, "Symlinks are not allowed")
+    elif normalized.startswith("bios" + os.sep):
+        parts = normalized.split(os.sep)
         if len(parts) >= 4:
             result.add_check(True, f"Correct placement: bios/{parts[1]}/{parts[2]}/")
         else:
             result.add_warning("File should be in bios/Manufacturer/Console/ structure")
     else:
-        result.add_warning(f"File is not under bios/ directory")
+        result.add_warning("File is not under bios/ directory")
 
     if name_known and not sha1_known and not md5_known:
         result.add_info(