security: constrain renderer application protocol

[gronbow]

Summary

• replace the renderer file URL with a constrained pulse-app://dashboard protocol
• serve only five immutable packaged assets with response-level CSP, explicit MIME types, and nosniff
• keep IPC sender validation pinned to the exact dashboard entry URL
• add unit, real-renderer, and packaged-ASAR protocol checks
• refresh the public security, threat-model, development-status, and repository-audit documentation
• update lock-only build dependencies to fast-uri 3.1.7 and @xmldom/xmldom 0.8.15 for newly disclosed advisories

Verification

• npm run test:ci
• npm run pack:win
• npm run test:packaged
• clean-install dependency audit: 0 vulnerabilities
• working-tree and committed-HEAD privacy audits
• visual review of dark/light, unavailable, safety, and 16:9 / 4:3 / 21:9 screenshots

Review order

This is a stacked Draft PR based on #13, which is based on #12. Review and merge in the order #12 → #13 → this PR. Merge and release remain separately approval-gated.