Harden Windows DLP enforcement and Electron runtime packaging

apps/browser/transport-deny.cjs

@@ -0,0 +1,14 @@
+'use strict';
+// Frame-only defense against unsupported native RTC paths. This exports no bridge
+// and is additional to the browser-process connection policy, not message DLP.
+function denyUninspectedRTC(){
+  const SecurityException=DOMException;
+  function blockedPeerConnection(){throw new SecurityException('Managed WebRTC inspection is unavailable','NotAllowedError');}
+  Object.freeze(blockedPeerConnection.prototype);Object.freeze(blockedPeerConnection);
+  for(const name of ['RTCPeerConnection','webkitRTCPeerConnection','mozRTCPeerConnection']){
+    if(name in globalThis)Object.defineProperty(globalThis,name,{value:blockedPeerConnection,writable:false,configurable:false,enumerable:true});
+  }
+}
+if(process.sandboxed!==true||process.contextIsolated!==true){require('electron').ipcRenderer.send('managed:transport-guard-failure');window.stop();throw Error('Managed transport isolation is required');}
+try{require('electron').contextBridge.executeInMainWorld({func:denyUninspectedRTC});}
+catch{require('electron').ipcRenderer.send('managed:transport-guard-failure');window.stop();throw Error('Managed transport guard could not be installed');}