🔒 Fix arbitrary file write in caption download

Use pkg.Root.OpenFile instead of os.Create to prevent path traversal
attacks in the MCP caption-download tool (GHSA-2c7f-fxww-6w6c).

pkg/caption/caption.go

@@ -269,7 +269,7 @@ func (c *Caption) Download(writer io.Writer) error {
 		return errors.Join(errDownloadCaption, err)
 	}
 
-	file, err := os.Create(c.File)
+	file, err := pkg.Root.OpenFile(c.File, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
 	if err != nil {
 		return errors.Join(errDownloadCaption, err)
 	}