fix(bootstrap): harden archive names, the cancel window and quit wait

The bootstrap preflight's protected names could be bypassed by names
that resolve onto them, and its cancel and quit paths had two timing
gaps.

- Entry names are judged as the file system resolves them: '\' is a
  separator, "." components are dropped and each component loses its
  trailing dots and spaces, as Win32 does ("./wallet.dat" and
  "DRAGONX.conf." name protected files). The whole archive is refused
  for an absolute or drive-rooted name, a ".." component, any ':'
  (drive letter or NTFS alternate data stream, "DRAGONX.conf::$DATA"),
  an 8.3 short name ("DRAGON~1.CON"), a component of only dots or
  spaces (other than "."), and any byte >= 0x80 or ASCII control
  character: macOS folds or ignores some Unicode (U+017F, U+212A,
  U+200C) onto a protected name, and the published bootstrap archive
  uses plain ASCII names. A refused name is echoed
  with \xNN escapes. A member is written at the path it was checked
  under, and the protected-name check runs on the resolved name.
- The user's Cancel (Settings dialog and first-run wizard) goes through
  requestCancel(). It is refused once the old chain data starts being
  replaced, and the start of that window re-checks a cancel under the
  same lock, so a click lands before the old chain is touched or not at
  all.
- Quit cancels the wizard's and the Settings bootstrap when the
  shutdown starts; the HEAD and checksum requests now end at once on
  cancel, and a cancelled HEAD keeps the partial download. A run
  cancelled before the window leaves the old chain as it was. A run
  inside it stops extracting and removes its partial chain while the
  shutdown screen shows "Cleaning up...", so it ends with no chain data
  (wallet.dat untouched; Retry reuses the zip, or the node resyncs).
  That wait is bounded: at most 2 minutes from the start of the
  shutdown, then 3 s in shutdown(), after which a worker still running
  is left to the process exit. Only a cleanup that overruns that cap
  can leave a partial chain, which dragonxd then answers with its
  reindex offer.

Tests: refusal of the Windows-resolved, non-ASCII and control-character
names with the escaped echo; the protected-name list incl. the resolved
forms and a planted -wallet file, conf and database/ that stay
byte-identical; the user-cancel window; the bounded quit wait and
safeToAbandon(); a cancel ends a HEAD request that never answers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/util/bootstrap.h

@@ -8,6 +8,7 @@
 #include <vector>
 #include <mutex>
 #include <atomic>
+#include <chrono>
 #include <thread>
 #include <cstdint>
 #include <filesystem>
@@ -86,9 +87,24 @@ public:
     void startFromZip(const std::string& dataDir, const std::string& zipPath,
                       DaemonUpFn daemonUp = {}, SpaceFn spaceFn = {});
 
-    /// Cancel an in-progress download/extract.
+    /// Cancel an in-progress download/extract. Unconditional: for quit and the destructor, which may abort
+    /// the destructive window too (the partial chain is then removed again).
     void cancel();
 
+    /// The user's Cancel: refused (returns false, nothing changes) once the destructive window has started
+    /// (Progress::cancellable false). The window's start re-checks the request under the same lock, so a
+    /// click either lands before the old chain data is touched or not at all.
+    bool requestCancel();
+
+    /// Quit: true once leaving the worker to the process exit can no longer leave a part-replaced chain: it
+    /// has finished, or it is cancelled and has not opened the destructive window (the window's start
+    /// re-checks the cancel under the same lock, so it never will).
+    bool safeToAbandon() const;
+
+    /// Quit: cancel() and wait for the worker until `deadline`. True = finished (the object can be destroyed);
+    /// false = still running, and the caller must leave it to the process exit (destroying it would join).
+    bool cancelAndWait(std::chrono::steady_clock::time_point deadline);
+
     /// Thread-safe read of current progress.
     Progress getProgress() const;
 
@@ -99,7 +115,8 @@ public:
     /// Format a byte count as human-readable string (e.g. "1.24 GB")
     static std::string formatSize(double bytes);
 
-    /// Preflight: open the zip, refuse it if any entry is unsafe (zip-slip) or unreadable, and sum the
+    /// Preflight: open the zip, refuse it if any entry is unsafe (zip-slip; also any ':', an 8.3 "~N"
+    /// alias, or a component of only dots/spaces other than ".") or unreadable, and sum the
     /// uncompressed size of the members extract() would write (directories and protected names excluded).
     static ArchivePlan planArchive(const std::string& zipPath);
 
@@ -115,7 +132,9 @@ public:
                                 std::uint64_t reclaimable, std::string* msg);
 
     /// Snapshot members that are never extracted: any wallet* name, database/, *.conf, .cookie, and
-    /// top-level *.dat other than fee_estimates/peers/banlist.
+    /// top-level *.dat other than fee_estimates/peers/banlist. Judged case-insensitively on the name the
+    /// member lands on: "." components dropped, trailing dots/spaces and an NTFS stream suffix (":...")
+    /// stripped from each component, so "./wallet.dat" and "DRAGONX.conf." are protected too.
     static bool isProtectedEntry(const std::string& name);
 
 private: