Bug bash fixes: special-file reads, per-client lockout, prefs validation, security headers, kernel-thread guard, login feedback, error text; plus journal-quiet sudoers + journal groups, upload overwrite guard, machines pattern, dnf freshness, cron/services speed, clean version

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/files/files.go

@@ -206,6 +206,8 @@ func looksText(b []byte) bool {
 	return ctrl*20 < len(b)
 }
 
+// Open refuses anything that isn't a regular file: devices stream forever (/dev/zero),
+// FIFOs block on open, sockets can't be read. /proc files are regular and still work.
 func (Local) Open(_ context.Context, path string) (io.ReadCloser, error) {
 	st, err := os.Stat(path)
 	if err != nil {
@@ -214,6 +216,9 @@ func (Local) Open(_ context.Context, path string) (io.ReadCloser, error) {
 	if st.IsDir() {
 		return nil, errors.New("is a directory")
 	}
+	if !st.Mode().IsRegular() {
+		return nil, errors.New("not a regular file (device, pipe or socket)")
+	}
 	return os.Open(path)
 }