fix: v0.5.0 security and robustness fixes from the 2026-10-07 review

- Ask Claude: strip control characters, send as bracketed paste (closes #2)
- end: forget before kill, so ending from inside a session leaves no ghost (closes #3)
- reconnects use `attach --existing` and never resurrect ended/renamed sessions (closes #4)
- repo: git --no-optional-locks, no safe.directory override, refresh on connect/bell/60s (closes #5)
- uploads: unique names via mktemp, cleanup trap on hangup (closes #6)
- clipboard: write-only OSC 52 provider, tmux allow-passthrough off (closes #7)
- uploads: size check up front, streamed slices, idle timeout (closes #9)
- --list: path last in TSV rows, tolerant numbers (closes #10)
- tokens via curl config on stdin; userinfo stripped from remote URLs (closes #11)
- ttyd max clients 32 and at most 2 concurrent side-channel calls (#8; BroadcastChannel polling still open)
- tmux: fixed terminal-features index (no duplicates on re-source), no status-right clock

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

share/tmux.conf

@@ -6,10 +6,10 @@ set -s escape-time 10                  # Esc reaches Claude (interrupt) immediat
 set -s focus-events on
 set -s set-clipboard on                # tmux copy-mode -> OSC 52 -> browser clipboard
 set -s default-terminal "tmux-256color"
-set -as terminal-features ",xterm-256color:RGB"
+set -s terminal-features[90] "xterm-256color:RGB"  # fixed index: re-sourcing must not append
 set -g history-limit 50000
 set -g mouse on                        # wheel scrolls history; Shift+drag selects natively
-set -g allow-passthrough on
+set -g allow-passthrough off       # output may not bypass tmux (title/clipboard spoofing)
 set -g renumber-windows on
 
 # --- bells reach the browser (Claude's terminal_bell notifications) ----------
@@ -29,7 +29,7 @@ set -g status-position bottom
 set -g status-style "bg=#060c14,fg=#7fa3bf"
 set -g status-left "#[fg=#FF6B00,bold] #S #[fg=#3e607a,nobold]│ "
 set -g status-left-length 40
-set -g status-right "#[fg=#3e607a]devdesk #[fg=#00D4FF]%H:%M "
+set -g status-right ""
 set -g window-status-format " #I:#W "
 set -g window-status-current-format "#[fg=#030508,bg=#00D4FF,bold] #I:#W "
 set -g window-status-bell-style "fg=#FFB300,bold"