Harden Windows DLP enforcement and Electron runtime packaging

.env.example

@@ -65,3 +65,7 @@ EMBEDDING_MODEL_REVISION=
 # Optional external owner-only ML-DSA-87 PKCS8 PEM audit signing key.
 # Once enabled, restarting without the same key fails; archive public pin/head externally.
 AUDIT_SIGNING_KEY_FILE=
+# Optional upstream proxy credentials require an exact endpoint pin.
+# These are deployment-only; never publish passwords in policy bundles.
+SAFETYNET_PROXY_AUTH_HOST=
+SAFETYNET_PROXY_AUTH_PORT=