fix: harden copy/move/delete transfers, add CI, dead code cleanup

Audited every copy/move/delete path (local, remote same-host, cross-host)
and fixed:

- Shell command injection in same-host remote cp/mv (unescaped paths
  interpolated into exec strings); added remote.ShellQuote.
- Missing guard against copying/moving a directory into its own
  subdirectory, locally and on same-host remote transfers (unbounded
  recursion / disk fill). New regression tests in ops_test.go.
- Remote-to-remote same-path file copy silently truncating the source
  file via Create() before it finished being read.
- Overwrite warning ("N existing target(s)") never shown for remote
  destinations, only local ones.
- Remote same-host server-side cp never advancing the file-done counter
  (waited on -v output that was never requested).
- Removed a dead "plan-then-confirm" subsystem (5 functions, 2 message
  types, 2 unreachable Update() cases) superseded by the current design.
- Remote delete (SFTP) now runs as a cancellable job with the same
  progress modal as local delete, instead of a single blocking call.

Also add a CI workflow that runs build/vet/test on every push and PR,
since previously they only ran on release tags.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -0,0 +1,32 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Vendor Go modules
+        run: go mod vendor
+
+      - name: Build
+        run: GOFLAGS=-mod=vendor go build ./...
+
+      - name: Vet
+        run: GOFLAGS=-mod=vendor go vet ./...
+
+      - name: Test
+        run: GOFLAGS=-mod=vendor go test ./...