Add policy-bound credential submission and native DLP audit proofs

apps/browser/preload.cjs

@@ -30,6 +30,8 @@ contextBridge.exposeInMainWorld('safetynet', {
   vaultSave:entry=>ipcRenderer.invoke('managed:vault-save',entry),
   vaultDelete:id=>ipcRenderer.invoke('managed:vault-delete',id),
   vaultFill:id=>ipcRenderer.invoke('managed:vault-fill',id),
+  vaultPrepareSubmit:id=>ipcRenderer.invoke('managed:vault-prepare-submit',id),
   vaultGenerate:()=>ipcRenderer.invoke('managed:vault-generate'),
+  onVaultHandoff:callback=>{ipcRenderer.on('managed:vault-handoff',(_event,token)=>{callback();ipcRenderer.send('managed:vault-handoff-ack',token);});},
   onState:callback=>{const listener=(_event,data)=>callback(data);ipcRenderer.on('managed:state',listener);return()=>ipcRenderer.removeListener('managed:state',listener);}
 });