Comprehensive bugfix release v1.6.45

Fix ~70 issues across the entire codebase including security fixes,
error handling improvements, test stabilization, and code quality.

- Fix TLS race condition with reference-counted acquire/release
- Bind debug server to 127.0.0.1 instead of 0.0.0.0
- Add overall timeout to MegaWebFallback
- Stream update installer to disk instead of RAM buffering
- Add path traversal protection in JVM extractor
- Cache DdownloadClient with credential-based invalidation
- Add .catch() to all fire-and-forget IPC calls
- Wrap app startup, clipboard, session-log in try/catch
- Add timeouts to container.ts fetch calls
- Fix variable shadowing, tsconfig path, line endings
- Stabilize tests with proper cleanup and timing tolerance
- Fix installer privileges, scripts, and afterPack null checks
- Delete obsolete _upload_release.mjs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/extractor-jvm.test.ts

@@ -36,12 +36,8 @@ afterEach(() => {
   }
 });
 
-describe("extractor jvm backend", () => {
+describe.skipIf(!hasJavaRuntime() || !hasJvmExtractorRuntime())("extractor jvm backend", () => {
   it("extracts zip archives through SevenZipJBinding backend", async () => {
-    if (!hasJavaRuntime() || !hasJvmExtractorRuntime()) {
-      return;
-    }
-
     process.env.RD_EXTRACT_BACKEND = "jvm";
 
     const root = fs.mkdtempSync(path.join(os.tmpdir(), "rd-jvm-extract-"));
@@ -70,10 +66,6 @@ describe("extractor jvm backend", () => {
   });
 
   it("respects ask/skip conflict mode in jvm backend", async () => {
-    if (!hasJavaRuntime() || !hasJvmExtractorRuntime()) {
-      return;
-    }
-
     process.env.RD_EXTRACT_BACKEND = "jvm";
 
     const root = fs.mkdtempSync(path.join(os.tmpdir(), "rd-jvm-extract-"));