v0.5.2 - security update

Security update, 2026-10-28

• A sender-controlled message id could contain ../ and write outside the inbox or sent folder. Ids are now validated (^[a-zA-Z0-9][a-zA-Z0-9_-]{3,63}$) before use in file names.
• The replay check matched substrings, and an id starting with - was read as a grep option. It now matches the whole id.
• An attachment download URL taken from a message could be read by curl as an option. It must now start with http(s):// and is passed with --url.
• Private keys and registration files (which hold the provider API key) are created owner-only (umask 077) instead of being chmod-ed afterwards; agent directories are 0700.
• An empty provider on either side no longer counts as "same provider" (which was trusted).
• Temp files use mktemp. CI uses read-only permissions and Node 22.

Behaviour changes: agent directories are now 0700, and messages with ids outside the pattern above are refused. 10 new tests (359 total). See CHANGELOG.md.