fix: constrain theme and image file paths

[PathGao]

Fixes #248.
Fixes #250.

Summary

• Reject traversal, separators, and absolute paths in theme names and image path components.
• Canonicalize image directories after creation and reject symlinked directories outside the document parent.
• Prevent existing image symlinks from escaping the document parent.
• Use atomic writes for application theme state, downloaded themes, and decoded image data.
• Reject failed VSIX downloads and bound download size, archive entry count, expanded size, and manifest/theme JSON sizes.

Validation

• project-local Cargo test: 4 passing Rust tests

[PathGao]

@alecdotdev #249 is ready as the first PR in a verified merge sequence.

I rebased it on current master, resolved the #228 overlap while preserving the CommonMark regression coverage, and verified cargo test (19 tests) plus npm run check.

The follow-up PRs are intentionally stacked and have been squash-merge simulated without conflicts in this order:

1. fix: constrain theme and image file paths #249
2. fix: ignore stale preview renders #254
3. fix: guard viewer initialization after disposal #258
4. fix: recover from interrupted session restores #260

Their GitHub CI is currently running. Once #249 is green, it can be merged first; please merge the remaining PRs in that order after their checks pass.

[PathGao]

@alecdotdev Please hold the earlier merge sequence for a P0 regression: #264 reports a deterministic Windows release abort when fenced code contains multibyte-leading content. I opened #265 with the isolated scanner fix and a Rust reproduction test.

#265 should be reviewed and merged before #249. After it lands, I will rebase #249 and then rebuild the #249 → #254 → #258 → #260 sequence on the fixed master.