Harden Windows DLP enforcement and Electron runtime packaging

tests/admin-controls-ui.test.mjs

@@ -26,3 +26,5 @@ test('controlled credential submission and agent preparation start off and round
 });
 
 test('visual export remains separate unchecked page-only opt-in in central and individual grants',()=>{const source=readFileSync(new URL('../apps/server/public/admin.js',import.meta.url),'utf8'),scopes=vm.runInNewContext(source.match(/const agentScopes=(\[[^;]+\]);/)[1]);assert.ok(scopes.includes('screenshot'));const tag=html.match(/<input[^>]*id="agent-scope-screenshot"[^>]*>/)[0];assert.equal(/\bchecked\b/.test(tag),false);for(const text of ['Export inspected foreground page viewport','does not authorize desktop, other windows or browser-interface capture','Sensitive-read permission does not bypass visual inspection'])assert.ok(html.includes(text));const editor=readFileSync(new URL('../apps/server/public/agent-grants-admin.js',import.meta.url),'utf8');assert.ok(editor.includes('for(const scope of agentScopes)'));assert.ok(editor.includes('check.checked=grant.scopes.includes(scope)'));assert.ok(editor.includes('check.disabled=!agentGrantsEditable'));assert.ok(editor.includes('never the desktop or browser interface'));});
+
+test('attributed worker controls default off and profile editor cannot widen baseline',()=>{for(const id of ['agent-background-workers','agent-scope-network:background'])assert.equal(/\bchecked\b/.test(html.match(new RegExp(`<input[^>]*id="${id}"[^>]*>`))[0]),false);assert.ok(html.includes('not an RPC action'));assert.ok(html.includes('human/default/shared/legacy workers'));const select=html.match(/<select id="profile-agentBackgroundWorkers">([\s\S]*?)<\/select>/)[1];assert.ok(select.includes('value="inherit"'));assert.ok(select.includes('value="deny"'));assert.ok(!select.includes('value="allow"'));const editor=readFileSync(new URL('../apps/server/public/profile-admin.js',import.meta.url),'utf8');assert.ok(editor.includes("'agentBackgroundWorkers'"));});