fix: address final review (path traversal, sync races, MCP limits)

Findings from a Codex (gpt-6.1-sol, xhigh) review of v0.2.4..HEAD, each
verified in the code before fixing:

- high: ticker symbols reached cache file paths unchecked, so a symbol
  like `../../REPORT` read (and deleted, if unparseable) .json files
  outside the cache, reachable through MCP get_quotes. resolve_symbol now
  accepts only ticker characters, and cache keys are encoded as single
  safe path components.
- high: sync decided before downloading and replaced the database
  without rechecking; an import that landed meanwhile was erased. It now
  rechecks the local state before installing, and idx-mcp runs
  ownership_sync exclusively with ownership reads.
- replaces_sqlite_sha256 never downgrades history: the client requires
  the rebuild to keep at least the local release count, and the
  publisher lists a replaced build only then.
- cache writes are atomic (temp file + rename), so concurrent readers
  never see, and delete, a partial entry.
- idx-mcp caps symbols (20, deduplicated) and limits, and runs at most 4
  tool calls at once.
- each Yahoo client gets its own cookie jar, paired with its crumb.
- ZIP entries (XLSX, KSEI archives) are read with a 256 MiB bound;
  non-ASCII archive dates and huge percentages are parse errors instead
  of panics or overflow.
- agent-smoke --keep deletes every copied agent config, not only auth
  files.

CLI goldens unchanged; the MCP tool golden changes only to state the
new caps.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/idx-mcp/tests/mcp.rs

@@ -279,6 +279,22 @@ fn errors_carry_cli_codes() {
         assert_eq!(body["code"], "INVALIDINPUT", "{tool}");
     }
 
+    let many: Vec<String> = (0..21).map(|i| format!("S{i}")).collect();
+    for (tool, arguments) in [
+        ("get_quotes", json!({"symbols": many})),
+        ("screen_stocks", json!({"limit": 201})),
+        ("screen_stocks", json!({"limit": 0})),
+        ("get_quotes", json!({"symbols": ["../../REPORT"]})),
+    ] {
+        let (is_error, body) = client.call(tool, arguments.clone());
+        assert!(is_error, "{tool} {arguments}: {body}");
+        assert_eq!(body["code"], "INVALIDINPUT", "{tool} {arguments}");
+    }
+    // Duplicates collapse instead of counting against the cap.
+    let repeated = vec!["BBCA"; 50];
+    let quotes = client.ok("get_quotes", json!({"symbols": repeated}));
+    assert_eq!(quotes["quotes"].as_array().unwrap().len(), 1);
+
     // Empty ownership database: investor tools point at the sync path.
     let status = client.ok("ownership_status", json!({}));
     assert_eq!(status["populated"], false);