[Linuxuser67]

Summary

Fixes the required release-metadata findings and the extension-server lifecycle issues from the independent audit.

• Replace yt-dlp's third-party release fetcher with a Grab-proxied GitHub API request, bounded metadata reads, and the existing app User-Agent/Accept conventions.
• Share Deno/yt-dlp release parsing: validate tags, require the expected official asset URL, and accept only valid SHA-256 digests. Missing/invalid digests still fail closed during installation.
• Repair suppression lifecycle tracking with per-request IDs/cutoffs. Declines remove only their own pending suppression; approved tombstones remain only while older staged jars exist and are pruned when jars are replaced, discarded, or evicted.
• Configure Hyper's timer-backed HTTP/1 header-read timeout and a total connection deadline to close stalled requests/bodies.
• Remove incomplete cookie staging files when writes fail.
• Sync the install directory after successful Deno/yt-dlp renames; remove the redundant Deno destination symlink pre-check that introduced a TOCTOU window.
• Add regression tests for release URL/tag/digest validation, suppression cutoff restoration/reclamation/boundedness, header-read timeout, and stalled-body timeout.

Independent review

Reviewed the complete four-file diff against the supplied Rust best-practices and Rust-review guidance before pushing this branch. The patch reuses Hyper 1.12.0, hyper-util 0.1.21, and Tower 0.5.3 already present in Cargo.lock; the lockfile only adds them to Grab's direct dependency list.

Validation

The local environment does not have rustc, cargo, or rustfmt, and local GitHub DNS access is unavailable. Therefore cargo fmt --check, Clippy, and Rust tests were not run locally. Please use the repository's GitHub Actions checks to validate formatting, compilation, tests, and vendor/lockfile consistency.