Harden Windows DLP enforcement and Electron runtime packaging

tests/agent-control.test.mjs

@@ -147,6 +147,7 @@ test('bookmark mutation schema requires exact revision and rejects extra capabil
   assert.equal((await request('bookmarks:mutate',{...args,expectedRevision:-1})).status,400);
   assert.equal((await request('bookmarks:mutate',{...args,approve:true})).status,400);
   assert.equal((await request('bookmarks:mutate',{...args,bookmark:{...args.bookmark,managed:true}})).status,400);
+  // eslint-disable-next-line no-unused-vars -- The test deliberately removes the optional folder field from the request.
   const {folder,...withoutFolder}=args.bookmark;
   assert.equal((await request('bookmarks:mutate',{...args,bookmark:withoutFolder})).status,200);
   assert.equal(captured.bookmark.folder,'');