fix: SFTP overwrite data loss and Windows open_remote cmd injection

[cursor]

Summary

• Recursive SFTP directory downloads no longer delete existing local files before the replacement transfer succeeds (failed/cancelled overwrite no longer causes silent local data loss).
• Incomplete uploads now fail before promoting .termifai-uploading over the remote destination, so a truncated local source cannot wipe a good remote file.
• sftp_open_remote first-success path on Windows now uses ShellExecuteW (not cmd /c start), and temp directory components from session_id are sanitized against cmd metacharacters.

Impact

• Data loss: directory download overwrite + incomplete upload promote-before-check.
• Security: residual Windows command injection via crafted synced host/session ids in the open-remote fast path.

Validation

• cargo +1.88.0 test --locked -p termifai --lib sftp::tests:: — 22 passed (includes new should_promote_upload / sanitize_temp_path_component tests).

Test plan

• Download a remote directory into a local tree with an existing nested file; choose overwrite; cancel/fail mid-transfer — existing local file remains.
• Upload overwrite where the local file shrinks during transfer — remote destination stays intact; error reports incomplete upload.
• On Windows, Open a remote file from an SFTP session whose host id contains & — opens via ShellExecute without spawning extra commands.