github.com/streambinder/spotitube

fix(anchor): guard style write in Lot.Close with lock

Close mutates style without holding window lock while Print iterates
all lots and reads style in write, causing race in TestCmdSync.
Hold lock for style mutation so read and write are serialized.

Closes race detected in CI.

refactor: replace arbitrary channel buffer sizes

Use unbuffered channels for progress-only notifications (indexed,
fetched) and a named pipelineBuffer constant for inter-stage queues.

fix(ci): use GitHub environment for secrets access

Replace inline zizmor suppression annotations with a dedicated
`secrets` environment (deployment: false). This both fixes the
block scalar contamination bug (annotations inside YAML | blocks
were baked into -ldflags -X values) and properly scopes secret
access to an environment, satisfying secrets-outside-env audits
across all zizmor versions.

feat(auth): show authenticated username in sync status

fix(anchor): preserve prompt line when reading user input

After reading user input in Reads(), clear the blank line created by
Enter and position cursor correctly without erasing the prompt line.
This prevents duplicate anchor lines and maintains proper TUI state.

chore(deps): bump actions/checkout from 5 to 6

Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/[email protected])

---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>