Release v1.4.18 with performance optimization and deep bug fixes

- Optimize session cloning: replace JSON.parse/stringify with shallow spread (~10x faster for large queues)
- Convert blocking fs.existsSync/statSync to async on download hot path
- Fix EXDEV cross-device rename in sync saveSettings/saveSession (network drive support)
- Fix double-delete bug in applyCompletedCleanupPolicy (package_done + immediate)
- Fix dangling runPackageIds/runCompletedPackages in removePackageFromSession
- Fix AdmZip partial extraction: use overwrite mode for external fallback
- Add null byte stripping to sanitizeFilename (path traversal prevention)
- Add 5MB size limit for hash manifest files (OOM prevention)
- Add 256KB size limit for link artifact file content check
- Deduplicate cleanup code via centralized removePackageFromSession

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/utils.test.ts

@@ -12,6 +12,8 @@ describe("utils", () => {
   it("sanitizes filenames", () => {
     expect(sanitizeFilename("foo/bar:baz*")).toBe("foo bar baz");
     expect(sanitizeFilename("   ")).toBe("Paket");
+    expect(sanitizeFilename("test\0file.txt")).toBe("testfile.txt");
+    expect(sanitizeFilename("\0\0\0")).toBe("Paket");
   });
 
   it("parses package markers", () => {