fix: harden usenet/debrid downloaders from critico review

- Consolidate 3 maps (active, taskDirs, taskTrackers) into single
  activeDownload struct — eliminates out-of-sync state on mid-function panic
- Cancel() runs os.RemoveAll in background goroutine (non-blocking)
- Flush(): clear dirty before unlock to prevent concurrent flush race on
  same tmp file; remove fragile re-mark-on-error pattern
- Revert RWMutex → Mutex in ProgressTracker (negligible benefit under
  write-heavy workload, higher overhead)
- Remove file.Sync() from debrid and usenet downloaders (Close flushes
  kernel buffers; fsync blocks for seconds on large files)
- Pin golangci-lint to v2.1.6 in CI (was floating with `latest`)
- Fix CI matrix: Go 1.25+1.26 (was 1.24+1.25, but go.mod requires 1.25)

internal/usenet/download/downloader.go

@@ -109,12 +109,7 @@ func (d *Downloader) DownloadFile(ctx context.Context, file nzb.File, fileIndex
 			outFile.Truncate(totalBytes)
 		}
 	}
-	defer func() {
-		if err := outFile.Sync(); err != nil {
-			log.Printf("[usenet] sync warning: %v", err)
-		}
-		outFile.Close()
-	}()
+	defer outFile.Close()
 
 	// Download segments using worker pool
 	var downloaded atomic.Int64