Harden Windows DLP enforcement and Electron runtime packaging

tests/package-fuses.test.mjs

@@ -0,0 +1,6 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {hardenedElectronFuses,assertEmbeddedIntegrity} from '../scripts/package-fuses.mjs';
+test('production fuses close alternate Node entry points and require encrypted cookies and ASAR integrity',()=>{assert.deepEqual(hardenedElectronFuses,{runAsNode:false,enableCookieEncryption:true,enableNodeOptionsEnvironmentVariable:false,enableNodeCliInspectArguments:false,enableEmbeddedAsarIntegrityValidation:true,onlyLoadAppFromAsar:true});});
+test('Windows integrity metadata binds exact packaged archive header and rejects missing duplicate or altered values',()=>{const header='synthetic header',entry={file:'resources\\app.asar',alg:'SHA256',value:createHash('sha256').update(header).digest('hex')};assert.doesNotThrow(()=>assertEmbeddedIntegrity([entry],header));for(const entries of [[],[entry,entry],[{...entry,file:'app.asar'}],[{...entry,alg:'MD5'}],[{...entry,value:'0'.repeat(64)}]])assert.throws(()=>assertEmbeddedIntegrity(entries,header));assert.throws(()=>assertEmbeddedIntegrity([entry],header+'tampered'));});