Two follow-ups to the earlier drag-out cache fix, surfaced by
running the feature branch against a 458 GB stale cache:

1. Startup prune was synchronous — rmSync on hundreds of GB
   blocked the Electron main process long enough to crash the
   renderer (ACCESS_VIOLATION). Switch to fs.promises and
   fire-and-forget so startup never awaits filesystem cleanup.

2. event.sender.startDrag({ file: directoryPath }) is unreliable
   on Windows — large directories crash outright, small ones
   don't consistently land at the drop target. Skip drag-out for
   directories entirely. Internal SFTP-to-SFTP drag still works
   via the HTML5 dataTransfer channel; users who want to download
   a remote directory should use the transfer panel.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Replaces the spawn-scp-subprocess pre-cache approach with a streaming
pipeline that runs through the already-open SFTP transport:

- Single-file drag: stream the remote file into a deterministically
  named staging path in %TEMP%/hypershell-drag, then hand it to the
  OS via event.sender.startDrag.
- Directory drag: walk the remote tree via the SFTP transport, stream
  each entry into a yazl ZipFile, and drag the resulting .zip.
  (Previously a directory drag either triggered `scp -r` of the whole
  tree into temp with no cleanup, or crashed Electron outright because
  startDrag({ file: directoryPath }) is unreliable on Windows.)
- New fire-and-forget IPC `sftp:drag-out:start-native` (via
  ipcRenderer.send / ipcMain.on) for the two-phase directory drag:
  first drag triggers the zip build and shows a "preparing" toast;
  once the "ready" toast fires, subsequent drags hit the cached zip
  and initiate the native drag immediately.
- No more click-based pre-staging. Selecting a row in the SFTP pane
  is now free — staging only runs in response to an actual dragstart.
  (The previous design silently scp'd every row the user clicked;
  one user accumulated over a million cached files before noticing.)
- startDrag icon: use app.getFileIcon on the staged file (returns the
  real Windows shell icon for .zip etc.); fall back to a stub only
  when the shell lookup fails. Windows rejects startDrag with an
  empty NativeImage, which was silently killing the drag ghost.
- Startup prune: async fs.promises.rm, 1-hour TTL (drag cache has no
  long-term value), fire-and-forget so app launch never blocks on
  multi-GB rm.
- Per-drag cleanup: 5-minute best-effort removal after startDrag;
  handles both the .zip and the underlying staged directory.
- Extract testable helpers (stageSftpDragOutItem, shouldStartNativeDragOut,
  pruneDragOutCache, resolveSafeDragOutPath) and add 18 unit tests
  covering staging, archival of mixed-readable trees, prune TTL, and
  path-traversal rejection.

479/479 tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>