Ghost FTP 0.95.28 — macOS FTP command control-character safety (development preview)

Expected published predecessor: v0.95.27. The branch must remain unreleased until that predecessor is actually public and immutable.

Native macOS changes

Reject all ASCII C0 control codepoints (0x00–0x1F) and DEL (0x7F) in FTP control-channel argument strings, rather than only CR/LF/NUL.
Protect the existing FTP-only native username/password, PWD/CWD, listing, upload/download and file-operation command paths through their shared argument validator.
Preserve Unicode paths and printable filename spaces.
Add XCTest regressions for rejected TAB, ESC/ANSI, BS and DEL filenames/operands, and accepted Unicode paths.
Synchronize shared version metadata to 0.95.28 Preview; Windows/Linux and Android feature sets are otherwise unchanged.

Exact-head macOS unit and real FTP E2E tests.
Windows/Linux native builds, Rust/Clippy, Android, product/docs and protocol CI.
Real macOS device and server interoperability acceptance.
Native macOS explicit FTPS/SFTP, SSH host-key identity, signing/notarization and production distribution — still P0 issue #157.

This is a scoped security improvement, not FileZilla parity or a production-stable release.