Fix CI: update test for new Content-Disposition format and add changeset

- Update GetObject test to expect the sanitized filename with RFC 5987
  filename* parameter added by the header injection fix
- Add required changeset for the patch release

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: G4brym

.changeset/fix-content-disposition-injection.md

@@ -0,0 +1,5 @@
+---
+"r2-explorer": patch
+---
+
+Fix Content-Disposition header injection in GetObject by sanitizing filenames (replacing non-ASCII with `_` and double quotes with `'`) and adding RFC 5987 `filename*=UTF-8''...` parameter for proper Unicode support.

packages/worker/tests/integration/object.test.ts

@@ -147,8 +147,8 @@ describe("Object Specific Endpoints", () => {
 			expect(response.headers.get("content-type")).toBe(TEST_OBJECT_CONTENT_TYPE);
 			expect(response.headers.get("content-length")).toBe(TEST_OBJECT_CONTENT.length.toString());
 			expect(response.headers.has("etag")).toBe(true);
-			// Default R2 GetObject includes Content-Disposition: attachment; filename="key"
-			expect(response.headers.get("content-disposition")).toBe(`attachment; filename="${TEST_OBJECT_KEY}"`);
+			// Default R2 GetObject includes Content-Disposition with sanitized filename and RFC 5987 filename*
+			expect(response.headers.get("content-disposition")).toBe(`attachment; filename="${TEST_OBJECT_KEY}"; filename*=UTF-8''${encodeURIComponent(TEST_OBJECT_KEY)}`);
 
 			const body = await response.text();
 			expect(body).toBe(TEST_OBJECT_CONTENT);