Pin three untested guards: download timer, URL fragment, short APP1 (closes #89)

The download idle deadline's timer is unref'd so it never holds the
process open, and a test checks no timer is left after a download
completes or fails. A test covers the rejection of "#" in a request
path. The EXIF scan compares the Exif header only when the APP1 length
is at least 8, so it never reads the next segment's bytes.

Model: opus-5-5

test/cli/metadata-exif.test.ts

@@ -51,6 +51,13 @@ describe("extractExifFromJpeg", () => {
         expect(extractExifFromJpeg(bytes(SOI, app0, SOS))).toEqual({});
     });
 
+    it("ignores an APP1 segment too short to hold the Exif header", () => {
+        // Length 7 leaves room for "Exif\0" only. Without the length check
+        // the scan compared the header against bytes past the segment.
+        const short = app1(EXIF_HEADER.slice(0, 5));
+        expect(extractExifFromJpeg(bytes(SOI, short, SOS))).toEqual({});
+    });
+
     it("reports a JPEG truncated inside a segment header", () => {
         const scan = extractExifFromJpeg(bytes(SOI, [0xff, 0xe1, 0x00]));
         expect(scan.exif).toBeUndefined();