v0.4.8

Changes

• Add opt-in browser-terminal file downloads from the workspace controli-drive folder.
• Add --downloads and --download-approve=false host flags for relay and tunnel sessions.
• Restrict downloads to paths inside controli-drive, blocking absolute paths and directory traversal.
• Add download start, completion, denial, and error audit events.
• Add browser UI for requesting and saving downloads.

Verification

• CGO_ENABLED=0 go test ./...
• npm run docs:build
• make build