fix: harden copy/move/delete transfers, add CI, dead code cleanup

Audited every copy/move/delete path (local, remote same-host, cross-host)
and fixed:

- Shell command injection in same-host remote cp/mv (unescaped paths
  interpolated into exec strings); added remote.ShellQuote.
- Missing guard against copying/moving a directory into its own
  subdirectory, locally and on same-host remote transfers (unbounded
  recursion / disk fill). New regression tests in ops_test.go.
- Remote-to-remote same-path file copy silently truncating the source
  file via Create() before it finished being read.
- Overwrite warning ("N existing target(s)") never shown for remote
  destinations, only local ones.
- Remote same-host server-side cp never advancing the file-done counter
  (waited on -v output that was never requested).
- Removed a dead "plan-then-confirm" subsystem (5 functions, 2 message
  types, 2 unreachable Update() cases) superseded by the current design.
- Remote delete (SFTP) now runs as a cancellable job with the same
  progress modal as local delete, instead of a single blocking call.

Also add a CI workflow that runs build/vet/test on every push and PR,
since previously they only ran on release tags.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/fs/ops_test.go

@@ -87,6 +87,56 @@ func TestMovePathWithProgressContextCancelledBeforeStartKeepsSource(t *testing.T
 	}
 }
 
+func TestCopyPathWithProgressContextRejectsCopyIntoOwnSubdirectory(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	srcDir := filepath.Join(root, "src")
+	if err := os.MkdirAll(srcDir, 0o755); err != nil {
+		t.Fatalf("mkdir src: %v", err)
+	}
+	nestedDir := filepath.Join(srcDir, "nested")
+	if err := os.MkdirAll(nestedDir, 0o755); err != nil {
+		t.Fatalf("mkdir nested: %v", err)
+	}
+
+	_, err := CopyPathWithProgressContext(context.Background(), srcDir, nestedDir, false, TransferStats{}, nil)
+	if err == nil {
+		t.Fatalf("expected error copying directory into its own subdirectory, got nil")
+	}
+
+	entries, readErr := os.ReadDir(nestedDir)
+	if readErr != nil {
+		t.Fatalf("read nested dir: %v", readErr)
+	}
+	if len(entries) != 0 {
+		t.Fatalf("expected nested dir to remain empty, found %d entries", len(entries))
+	}
+}
+
+func TestMovePathWithProgressContextRejectsMoveIntoOwnSubdirectory(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	srcDir := filepath.Join(root, "src")
+	if err := os.MkdirAll(srcDir, 0o755); err != nil {
+		t.Fatalf("mkdir src: %v", err)
+	}
+	nestedDir := filepath.Join(srcDir, "nested")
+	if err := os.MkdirAll(nestedDir, 0o755); err != nil {
+		t.Fatalf("mkdir nested: %v", err)
+	}
+
+	_, err := MovePathWithProgressContext(context.Background(), srcDir, nestedDir, false, TransferStats{}, nil)
+	if err == nil {
+		t.Fatalf("expected error moving directory into its own subdirectory, got nil")
+	}
+
+	if _, statErr := os.Stat(srcDir); statErr != nil {
+		t.Fatalf("expected source to remain in place, stat err=%v", statErr)
+	}
+}
+
 func TestRenamePath(t *testing.T) {
 	t.Parallel()