fix: security hardening from codebase audit (password scoping, lock file, terminal escapes)

[jkleinne]

three small security hardening fixes

• rclone password no longer goes through os.Setenv into shuttle's own env — it's injected straight into the rclone child's cmd.Env, so rsync and /proc/self/environ never see it
• lock file moved off shared /tmp to a per-user runtime dir (XDG_RUNTIME_DIR, else a 0700 shuttle-<uid> subdir), opened O_NOFOLLOW 0600. Kills the predictable-path flock DoS and the symlink redirect on multi-user boxes
• strip control bytes from progress text so a malicious filename can't sneak terminal escapes onto your screen