Ghost FTP 0.99.17 — fallback state recovery hardening (Preview)

Previous published release: v0.99.16. Development source: 0.99.17 Preview.

Changes

Replace predictable compatibility runtime fallback-state temporary writes with private, unpredictable, fully synced same-directory staging.
Reject non-regular state and backup paths; protect the previous known-good backup until a new state file is committed.
Do not rotate a corrupt former state over a valid backup. Cover state recovery, corruption, symlink and failed-write scenarios with deterministic Go unit tests.
Keep existing JSON format, site identities and platform clients unchanged.
Synchronize development metadata across the existing Windows, Linux, macOS and Android build matrix.

This is a narrowly scoped compatibility-runtime durability fix, not certification of crash-proof or power-failure-proof persistence on every filesystem.
The 75 reference designs have no per-screen real installed-app acceptance; the newly attached v10 ZIP is byte-identical to the audited v8 ZIP.
Native macOS identity-verified explicit FTPS and SFTP still require issue #223. Ghost FTP Server has not been implemented; cross-platform client/server E2E is not available.
Release artifacts must be verified for exact source commit, signatures, packaging and installability by CI before any Preview publication. No stable-production claim.