- SFTP.js: validate handle/offset/len on REQUEST.READ; guard WRITE/FSETSTAT

handle access like other handlers (avoid throwing before doFatalSFTPError).
- bare-openssh-sftp: enqueueSftpReply(reqid, fn) sends SSH_FX_FAILURE on
  handler throw/reject; defensive READ path (buffer/finite offsets).
- Document regression (bad_optional_access / -fno-exceptions) in comments;
  add packages/bare-os-openssh/CHANGELOG.md Unreleased entry.

kernel/lib/bare/shell-completion.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "atMs": 1776806744827,
+  "atMs": 1776808769662,
   "commands": [
     "arch",
     "awk",