fix: harden scheduler, permissions, and download safety

- Implement scheduler hydration barrier to prevent premature triggers
- Track scheduler exact runs using keys to avoid false stops
- Use 'System Events' for accurate macOS automation permissions
- Prevent system-sleep via proper idle assertions
- Ensure download pauses use channel acknowledgements (PauseWithAck)
- Require Firelink ownership before replacing files in add/conflict UI
- Retain partial download assets when removing entries without deletion
- Clear progress state in store when downloads complete or pause to reduce churn
- Handle empty/invalid queue selections gracefully

src/components/DuplicateResolutionModal.tsx

@@ -8,6 +8,7 @@ export interface DuplicateConflict {
   fileName: string;
   reason: DuplicateReason;
   resolution: DuplicateResolution;
+  replaceAllowed?: boolean;
 }
 
 interface Props {
@@ -44,7 +45,7 @@ export const DuplicateResolutionModal = ({ conflicts: initialConflicts, onConfir
                 className="app-control w-24 shrink-0 px-2 py-1 text-xs"
               >
                 <option value="rename">Rename</option>
-                {conflict.reason.type === 'file' && <option value="replace">Replace</option>}
+                {conflict.reason.type === 'file' && conflict.replaceAllowed && <option value="replace">Replace</option>}
                 <option value="skip">Skip</option>
               </select>
             </div>