fix(launcher): address code review findings in stats sync

- merge-catalog: stop dropping anilist_id on every new anime insert
  (bun:sqlite .get() returns null, so the old !== undefined guard always
  fired); the guard was dead anyway since a colliding id is caught earlier
- sync-command: throw instead of fail() inside runHostSync so the finally
  block runs and temp dirs holding snapshot data are cleaned up on failure
- ssh: shell-quote the user-supplied --remote-cmd in the probe, and reject
  option-like (-prefixed) SSH hosts that ssh/scp would parse as flags
- sync-db: close the remote handle if opening the local DB throws
- sync-shared: treat EPERM from process.kill(pid, 0) as alive, not dead
- cli-parser: trim the sync host before the mode-exclusivity check
- tests: cover anilist_id preservation, anilist-based anime matching, and
  the SSH host/shell-quote guards

launcher/sync/merge-catalog.ts

@@ -138,15 +138,9 @@ export function mergeAnime(
       );
       continue;
     }
-    // anilist_id is UNIQUE; drop it if another local row (matched by a
-    // different title key) already claims it.
-    const anilistTaken =
-      row.anilist_id !== null && byAnilist.get(row.anilist_id) !== undefined
-        ? null
-        : row.anilist_id;
-    const values = ANIME_COPY_COLUMNS.map((column) =>
-      column === 'anilist_id' ? anilistTaken : row[column],
-    );
+    // No local row matched by anilist_id (checked first in `existing` above)
+    // or title key, so the remote anilist_id — if any — is free to insert as-is.
+    const values = ANIME_COPY_COLUMNS.map((column) => row[column]);
     map.set(remoteId, insertRow(local, 'imm_anime', ANIME_COPY_COLUMNS, values));
     summary.animeAdded += 1;
   }