Harden Windows DLP enforcement and Electron runtime packaging

docs/controlled-credential-policy.md

@@ -6,7 +6,15 @@ Local password vault section. The new policy defaults off and requires explicit
 approved form rules. Human vault unlock remains required. No agent can unlock the
 vault or export passwords through this feature.
 
-An approved rule contains metadata only:
+Use Add approved login target to edit rule ID, exact action URL and the two field
+names in typed rows. Removing a row updates only the unpublished draft. Advanced
+JSON remains available; invalid or unknown metadata is rejected instead of silently
+discarded. Auditor controls are read-only and normal independent review remains
+authoritative. An actual Windows/Electron workflow created the rule through
+these four typed fields, verified independent signed publication/history restore
+and auditor read-only controls. The screenshot
+`artifacts/credential-submission-admin-controls.png` shows the synthetic rule;
+no credential values are entered. An approved rule contains metadata only:
 
 ```json
 {