merge: origin/main (v1.41.1.0 audit wave) into garrytan/daegu-v3

Conflicts resolved:
- VERSION: keep 1.42.0.0 (queue-advance past #1592's v1.41.1.0 claim,
  per CLAUDE.md workspace-aware ship rule)
- CHANGELOG.md: keep both entries — v1.42.0.0 Daegu wave on top,
  v1.41.1.0 audit wave below in reverse-chronological order
- package.json: bump version field to 1.42.0.0 to match VERSION

Auto-merged cleanly:
- browse/src/meta-commands.ts: both the screenshot-size-guard wiring
  from C16 (this branch) and the parsePdfFromFile JSON validation
  from PR #1592 (main) survive in the merged file. Verified by
  inspecting the imports + call sites + running both test surfaces
  green.
- All other v1.41.1.0 changes from main (scripts/build-app.sh sed
  hardening, mktemp fallback drops, security-classifier download
  cleanup, global-discover 64KB cap) pulled in unchanged.

Verified 77 wave + audit tests green after merge:
- browse/test/screenshot-size-guard.test.ts (7)
- browse/test/regression-pr1169-pdf-from-file-invalid-json.test.ts
- browse/test/security-classifier-download-cleanup.test.ts
- browse/test/find-browse.test.ts (5)
- test/gstack-paths.test.ts (9), test/gstack-gbrain-sync.test.ts (37)
- test/memory-ingest-no-put_page.test.ts (2)
- test/resolvers-gbrain-put-rewrite.test.ts (2)
- test/extension-pty-inject-invariant.test.ts (3)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/build-app.sh

@@ -94,7 +94,9 @@ if [ -f "$CHROMIUM_PLIST" ]; then
   if [ -f "$CHROMIUM_STRINGS" ]; then
     # InfoPlist.strings may be binary plist, convert to xml first
     plutil -convert xml1 "$CHROMIUM_STRINGS" 2>/dev/null || true
-    sed -i '' "s/Google Chrome for Testing/$APP_NAME/g" "$CHROMIUM_STRINGS" 2>/dev/null || true
+    # Escape sed replacement metachars (& / \) in $APP_NAME so unusual names can't break or inject into the s/// command.
+    APP_NAME_SED_ESCAPED=$(printf '%s' "$APP_NAME" | sed 's/[&/\]/\\&/g')
+    sed -i '' "s/Google Chrome for Testing/${APP_NAME_SED_ESCAPED}/g" "$CHROMIUM_STRINGS" 2>/dev/null || true
   fi
   # Replace Chromium's icon with ours so the Dock shows the GStack icon
   # (Chromium's process owns the Dock icon, not our launcher)
@@ -177,7 +179,11 @@ echo "  Creating DMG..."
 rm -f "$DMG_PATH"
 
 # Create a temporary directory for DMG contents
-DMG_TMP=$(mktemp -d)
+DMG_TMP=$(mktemp -d) || { echo "ERROR: mktemp -d failed — refusing to continue so we don't cp into the filesystem root." >&2; exit 1; }
+if [ -z "$DMG_TMP" ] || [ ! -d "$DMG_TMP" ]; then
+  echo "ERROR: mktemp -d returned an invalid path ('$DMG_TMP')." >&2
+  exit 1
+fi
 cp -a "$APP_DIR" "$DMG_TMP/"
 ln -s /Applications "$DMG_TMP/Applications"