Harden Windows DLP enforcement and Electron runtime packaging

apps/browser/agent-grants.cjs

@@ -59,6 +59,7 @@ async function persistConnection({filePath,connection,protect,isCurrent}){
   guard(target);fd=fs.openSync(temporary,'wx',0o600);fs.writeFileSync(fd,bytes);fs.fsyncSync(fd);fs.closeSync(fd);fd=undefined;
   if(!isCurrent())throw Error('Agent credential context changed');guard(target);fs.renameSync(temporary,target);
   return target;
+ // eslint-disable-next-line no-unsafe-finally -- Cleanup failure must fail closed rather than report successful protected cleanup.
  }finally{bytes.fill(0);if(fd!==undefined)fs.closeSync(fd);try{fs.unlinkSync(temporary);}catch(error){if(error.code!=='ENOENT')throw error;}}
 }
 module.exports={activeGrants,authorizeGrant,reconcileGenerationFloor,descriptorPath,persistConnection};