Harden Windows DLP enforcement and Electron runtime packaging

apps/server/evidence.mjs

@@ -7,6 +7,7 @@ import {installEvidenceChannel} from './evidence-channel.mjs';
 import {assertPrivateEvidenceKey} from './evidence-key.mjs';
 import {InteractionEvidenceSchema} from '../../packages/core/evidence.mjs';
 
+// eslint-disable-next-line no-control-regex -- Explicitly reject control characters in security-sensitive input.
 const text=z.string().max(16000).refine(v=>!/[\u0000-\u0008\u000b\u000c\u000e-\u001f]/.test(v),'Control characters forbidden');
 const url=z.string().max(4096).refine(v=>{try{const u=new URL(v);return ['https:','http:'].includes(u.protocol)&&!u.username&&!u.password&&!u.search&&!u.hash;}catch{return false;}},'Evidence URLs require HTTP(S), no credentials, query or fragment');
 const digest=z.string().regex(/^[a-f0-9]{64}$/);