Ghost FTP 0.95.2 — development candidate (NOT PUBLISHED)

Why this patch train is necessary

The verified public v0.95.1 was published on 12 October 2026, at ad3f9b546600dea53fbf5a9b14b1dd7799d84fcf, before the later macOS cancellation-race patch was merged into main at 8867a7797367f06f2a611b7078abc96cc650ef63. The existing CI correctly rejected reuse of an immutable release tag. Keep v0.95.1 and all published assets unchanged.

Real improvements carried into 0.95.2 source

• Carry forward PR #133's macOS signed-cloud transfer cancellation fix: synchronized Process.run() and task cancellation, active-curl termination, cancellation error propagation, two XCTest regression tests and source-contract assertions.
• Restore coherent 0.95.2 source metadata across desktop (Tauri/React/Rust), Rust Cargo.lock, Android versionCode/versionName, Go tools, updater template and release-facing documentation.
• Keep strict tag collision and exact-source release lineage validation active; this fixes the source/release mismatch, not the safeguard.

Remaining acceptance gates — no automatic 'FINAL' claim

• Six GitHub workflows green on the same final PR head and merged main commit, with Windows/Linux/Android/macOS artifacts checked against SHA-256 sums.
• #126: live public cloud provider PUT/GET, DNS rebinding/proxy/VPN adversarial tests and physical macOS cancellation proof.
• #127: Android SAF provider partial-write, permissions, disk-full, cancellation and recovery tests on devices.
• #128: authenticated cloud OAuth provider accounts with PKCE, token lifecycle, paging and E2E.
• #131: 30 Windows, 29 Linux and 16 Android real screenshot comparisons and clickable functional QA against the supplied reference ZIP.
• macOS Preview is not a notarized production installer and does not claim full FTPS/SFTP functionality.

Do not merge or publish merely because the version metadata aligns. v0.95.2 has no public release tag at the time of this source change.