Harden Windows DLP enforcement and Electron runtime packaging

apps/browser/evidence-capture.cjs

@@ -15,7 +15,9 @@ function buildDownloadEvidence({url,name,mime,facts,decision,ruleId},policy){
   if(!facts||!Number.isSafeInteger(facts.size)||facts.size<0||!/^[a-f0-9]{64}$/.test(facts.sha256)||!['allow','block'].includes(decision))return null;
   let source;try{source=new URL(url);if(!['http:','https:'].includes(source.protocol))return null;source.username='';source.password='';source.search='';source.hash='';}catch{return null;}
   if(source.href.length>4096)return null;
+  // eslint-disable-next-line no-control-regex -- Explicitly reject control characters in security-sensitive input.
   const result={sourceUrl:source.href,name:safeFilename(name),sha256:facts.sha256,bytes:facts.size,mime:String(mime||'').split(';',1)[0].trim().toLowerCase().replace(/[\x00-\x1f\x7f]/g,'').slice(0,100),decision};
+  // eslint-disable-next-line no-control-regex -- Explicitly reject control characters in security-sensitive input.
   if(typeof ruleId==='string'&&ruleId.length<=100&&!/[\x00-\x1f\x7f]/.test(ruleId))result.ruleId=ruleId;
   return validateDownloadEvidence(result)?result:null;
 }