Harden Windows DLP enforcement and Electron runtime packaging

packages/core/policy-groups.mjs

@@ -13,6 +13,7 @@ export const GroupRestrictionsSchema=z.object({
  lockedSections:unique(z.enum(SETTINGS_SECTIONS),SETTINGS_SECTIONS.length).default([]),
  managedBookmarks:BookmarkItemsSchema.default([])
 }).strict();
+// eslint-disable-next-line no-control-regex -- Explicitly reject control characters in security-sensitive input.
 export const PolicyGroupSchema=z.object({id,name:z.string().min(1).max(100).refine(v=>!/[\u0000-\u001f\u007f]/.test(v)),
  memberDeviceIds:unique(id,10000),restrictions:GroupRestrictionsSchema,
  rollout:z.object({stage:z.enum(['pilot','expanded','all']),deviceIds:unique(id,10000).default([])}).strict()