Comprehensive bugfix release v1.6.45

Fix ~70 issues across the entire codebase including security fixes,
error handling improvements, test stabilization, and code quality.

- Fix TLS race condition with reference-counted acquire/release
- Bind debug server to 127.0.0.1 instead of 0.0.0.0
- Add overall timeout to MegaWebFallback
- Stream update installer to disk instead of RAM buffering
- Add path traversal protection in JVM extractor
- Cache DdownloadClient with credential-based invalidation
- Add .catch() to all fire-and-forget IPC calls
- Wrap app startup, clipboard, session-log in try/catch
- Add timeouts to container.ts fetch calls
- Fix variable shadowing, tsconfig path, line endings
- Stabilize tests with proper cleanup and timing tolerance
- Fix installer privileges, scripts, and afterPack null checks
- Delete obsolete _upload_release.mjs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/afterPack.cjs

@@ -2,8 +2,17 @@ const path = require("path");
 const { rcedit } = require("rcedit");
 
 module.exports = async function afterPack(context) {
-  const exePath = path.join(context.appOutDir, `${context.packager.appInfo.productFilename}.exe`);
+  const productFilename = context.packager?.appInfo?.productFilename;
+  if (!productFilename) {
+    console.warn("  • rcedit: skipped — productFilename not available");
+    return;
+  }
+  const exePath = path.join(context.appOutDir, `${productFilename}.exe`);
   const iconPath = path.resolve(__dirname, "..", "assets", "app_icon.ico");
   console.log(`  • rcedit: patching icon → ${exePath}`);
-  await rcedit(exePath, { icon: iconPath });
+  try {
+    await rcedit(exePath, { icon: iconPath });
+  } catch (error) {
+    console.warn(`  • rcedit: failed — ${String(error)}`);
+  }
 };