Release v1.4.18 with performance optimization and deep bug fixes

- Optimize session cloning: replace JSON.parse/stringify with shallow spread (~10x faster for large queues)
- Convert blocking fs.existsSync/statSync to async on download hot path
- Fix EXDEV cross-device rename in sync saveSettings/saveSession (network drive support)
- Fix double-delete bug in applyCompletedCleanupPolicy (package_done + immediate)
- Fix dangling runPackageIds/runCompletedPackages in removePackageFromSession
- Fix AdmZip partial extraction: use overwrite mode for external fallback
- Add null byte stripping to sanitizeFilename (path traversal prevention)
- Add 5MB size limit for hash manifest files (OOM prevention)
- Add 256KB size limit for link artifact file content check
- Deduplicate cleanup code via centralized removePackageFromSession

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/main/storage.ts

@@ -158,13 +158,26 @@ export function loadSettings(paths: StoragePaths): AppSettings {
   }
 }
 
+function syncRenameWithExdevFallback(tempPath: string, targetPath: string): void {
+  try {
+    fs.renameSync(tempPath, targetPath);
+  } catch (renameError: unknown) {
+    if ((renameError as NodeJS.ErrnoException).code === "EXDEV") {
+      fs.copyFileSync(tempPath, targetPath);
+      try { fs.rmSync(tempPath, { force: true }); } catch {}
+    } else {
+      throw renameError;
+    }
+  }
+}
+
 export function saveSettings(paths: StoragePaths, settings: AppSettings): void {
   ensureBaseDir(paths.baseDir);
   const persisted = sanitizeCredentialPersistence(normalizeSettings(settings));
   const payload = JSON.stringify(persisted, null, 2);
   const tempPath = `${paths.configFile}.tmp`;
   fs.writeFileSync(tempPath, payload, "utf8");
-  fs.renameSync(tempPath, paths.configFile);
+  syncRenameWithExdevFallback(tempPath, paths.configFile);
 }
 
 export function emptySession(): SessionState {
@@ -209,7 +222,7 @@ export function saveSession(paths: StoragePaths, session: SessionState): void {
   const payload = JSON.stringify({ ...session, updatedAt: Date.now() });
   const tempPath = `${paths.sessionFile}.tmp`;
   fs.writeFileSync(tempPath, payload, "utf8");
-  fs.renameSync(tempPath, paths.sessionFile);
+  syncRenameWithExdevFallback(tempPath, paths.sessionFile);
 }
 
 let asyncSaveRunning = false;