[kloptops]

…stop PortMaster

A hand-written version 3 port.json without "attr.runtime" stopped PortMaster starting (KeyError: 'runtime'). A fuzzer found the rest:

• port_info_load hands back the types everything else expects: name, status, source and files are checked and cleaned, min_glibc must be a version, runtimes must be plain file names.
• A port.json name with nothing left once cleaned ("/") is found from its items, like a missing one.
• ports.json: entries that aren't objects, have no download url, or have bad sections are skipped, not fatal. A string entry is no longer read as a port.json path. Util and runtime names must be file names.
• ports_info.json is cleaned when loaded: a port.json is only written to a "file" inside the ports folder, and owners need a usable name. port_stats.json download counts must be numbers.
• JSON nested too deeply loads as None instead of raising.
• is_safe_port_item also refuses NUL bytes and names too long for the file system; installed screenshots use it.
• muOS: the application folder comes from the script's own name, so a "../" in a files key can't reach outside the applications folder.
• Text the font can't draw ("\n", zero-width characters, a width narrower than a character) no longer crashes the GUI.

tests/test_fuzz_port_json.py fuzzes all of this through startup, sources, zip installs, ports_info.json and script signatures, the CLI and the GUI screens, checking every delete and write stays in the test's tmp dir. A short fixed-seed run is part of the suite; 100,000 cases per path on Python 3.7 and 3.11 found nothing more.