- SFTP.js: validate handle/offset/len on REQUEST.READ; guard WRITE/FSETSTAT

handle access like other handlers (avoid throwing before doFatalSFTPError).
- bare-openssh-sftp: enqueueSftpReply(reqid, fn) sends SSH_FX_FAILURE on
  handler throw/reject; defensive READ path (buffer/finite offsets).
- Document regression (bad_optional_access / -fno-exceptions) in comments;
  add packages/bare-os-openssh/CHANGELOG.md Unreleased entry.

kernel/etc/bare-os/posix_utilities.json

@@ -1,7 +1,7 @@
 {
   "schema": 2,
   "profileId": "bare-os-posix-like",
-  "generatedAt": "2026-04-21T21:25:44.827Z",
+  "generatedAt": "2026-04-21T21:59:29.663Z",
   "note": "Sparse POSIX Issue 7 coverage hints for /bin utilities. Omitted command names are not yet profiled here.",
   "commandIndex": [
     {