Security & Performance Refactor: Command Injection, Traversal, and Regressions

[BrandonS7]

Description

This PR applies a comprehensive 4-phase remediation of critical security vulnerabilities and performance bottlenecks, guided by multiple rigorous AI audits.

Security Fixes

1. Command Injection via shell=True: Completely removed the shell=True parameter from the primary cleanup dispatch (stats.py). All cleanup operations are now parsed safely with shlex.split and routed through a hardened safe_cleanup pipeline.
2. AppleScript Injection: Strictly sanitized application names in memory.py using a strict regex allowlist to prevent AppleScript injection when terminating processes, while safely supporting legitimate names with apostrophes and ampersands.
3. Arbitrary File Deletion / Symlink Traversal:
   • Replaced all instances of recursive rglob('*') with symlink-safe os.walk(followlinks=False) to prevent traversal beyond intended directories.
   • Added root-level symlink checks to prevent traversing linked roots in trash_contents.
   • Implemented strict base-path validation to ensure move_to_trash cannot delete anything outside ~, /Applications, or /Library/Caches.
4. TOCTOU Race & State-After-Mutation: Fixed a logic bug where file metadata was read after moving it to the trash (corrupting ML telemetry). Pinned symlink evaluation closer to deletion using lstat() to tighten the TOCTOU window.
5. Docker Label Injection: Sanitized Docker labels using a strict alphanumeric allowlist regex before displaying commands to the terminal.

Performance & Reliability Improvements

1. Unbounded Resource Consumption (scanners): Optimised find_space_hogs() from 17 recursive rglob traversals to a single O(N) pass via os.walk.
2. Permission Handling: Added onerror callbacks to all os.walk traversals to prevent PermissionError crashes from silently aborting the entire scan.
3. Exception Visibility: Converted ~50 instances of silent except Exception: pass into explicit logging warnings so failures are observable.
4. Chained Commands: Updated the new shell-less safe_cleanup to successfully process sub-commands separated by && (e.g. npm cache clean --force && rm -rf ...) so core functionality isn't degraded by the security patch.

Dependency Fixes

• Fixed version mismatches across files to consistently reflect 0.5.0.
• Declared missing required dependencies (psutil) in pyproject.toml.
• Added optional [project.optional-dependencies] test = ["pytest"].