Harden Windows DLP enforcement and Electron runtime packaging

tests/startup-security.test.mjs

@@ -21,3 +21,10 @@ test('broken command-line adapters fail closed with a static error',()=>{
 test('an already-active Node inspector is rejected even when no argv flag remains',()=>{
  const inspector=require('node:inspector'),original=inspector.url;try{inspector.url=()=> 'ws://private-main-debugger.internal:9229/secret';assert.throws(()=>assertSecureStartup(commandLine([]),[]),{message:'Unsafe browser startup configuration'});}finally{inspector.url=original;}
 });
+test('user feature overrides cannot disable native enforcement and never enter errors',()=>{
+ for(const flag of ['--disable-features=PrivateFeature','--disable-blink-features=PrivateFeature','--enable-features=PrivateFeature','--enable-blink-features=PrivateFeature','--enable-experimental-web-platform-features','-disable-features=PrivateFeature','/disable-features=PrivateFeature','/DISABLE-FEATURES=PrivateFeature','  --disable-features=PrivateFeature  ','\u0085/disable-features=PrivateFeature\u0085']){
+  assert.throws(()=>assertSecureStartup(commandLine([]),[],['browser.exe',flag]),{message:'Unsafe browser startup configuration'});
+ }
+ assert.equal(assertSecureStartup(commandLine(['disable-features']),[],['browser.exe','--lang=de']),true,'Electron internal defaults are not user overrides');
+ assert.throws(()=>assertSecureStartup(commandLine([]),[],[null]),{message:'Unsafe browser startup configuration'});
+});