Harden Windows DLP enforcement and Electron runtime packaging

packages/core/credential-policy.mjs

@@ -1,6 +1,7 @@
 import {z} from 'zod';
 
 export function credentialActionUrlAllowed(value){
+ // eslint-disable-next-line no-control-regex -- Explicitly reject control characters in security-sensitive input.
  try {const u=new URL(value);return u.protocol==='https:'&&!u.username&&!u.password&&!u.search&&!u.hash&&!value.includes('?')&&!value.includes('#')&&u.href===value&&!/[\u0000-\u0020\u007f]/.test(value);}catch{return false;}
 }
 const field=z.string().min(1).max(128).regex(/^[\x21-\x7e]+$/,'Credential field names require bounded printable ASCII');