Polish security fixes with minor improvements

- Remove redundant null termination for short strings
- Use descriptive variable names in cleanup loop
- Cache strlen results to avoid O(n²) complexity in string concatenation
- Add bounds checks before string operations

Co-authored-by: squassina <8495707+squassina@users.noreply.github.com>

src/fetch/common.h

@@ -77,8 +77,8 @@ void get_layout_abbr(char *abbr, const char *full_name) {
 		abbr[2] = '\0';
 	} else {
 		// 5. 最终回退：返回 "xx"
+		// strncpy will null-terminate since source is shorter than buffer
 		strncpy(abbr, "xx", LAYOUT_ABBR_SIZE - 1);
-		abbr[LAYOUT_ABBR_SIZE - 1] = '\0';
 	}
 }