fix(electron): restore the startup splash and launcher build checks

[zedarvates]

The launcher cannot compile because electron/main.ts imports and instantiates an unversioned SplashWindow. Restore the existing startup-status contract so the root npm run electron:build succeeds.

• Buffer pre-load updates, use literal text for status messages, bound progress and close safely on early/late lifecycle events.
• Keep Node integration disabled, context isolation and the BrowserWindow sandbox enabled, and deny navigation/new windows.
• Add 13 focused lifecycle/security tests, a real Electron splash smoke harness and path-filtered Node 22.12.0/24.19.0 CI. The Linux harness uses Xvfb with --no-sandbox only for CI; it does not establish runtime sandbox enforcement.
• Document the repository-root build entry point. config/package.json remains a legacy snapshot with stale relative paths.

Local validation on Node 24.19.0 / npm 11.9.0: npm ci --ignore-scripts --no-audit --no-fund, 13 splash tests, npm run electron:build and git diff --check pass. Before this patch, the same build fails with TS2307 for ./SplashWindow.

Follow-up to the build blocker documented in reviews of #70 and #63. This PR changes no dependency versions and merges neither dependency PR. Current-head Actions/Sonar evidence must be checked after publication.

Scope limits: no complete-app startup, Creative Studio renderer, live provider/backend, packaging or macOS/Windows acceptance is claimed. Creative Studio has its own existing Vite and TypeScript failures; this patch does not waive them.

Current-head evidence — 2026-10-03

Electron Launcher CI run 37132545155 is successful on 3a8cac25a11ed207192d443562f899cecb54aede. Both Node 22.12.0 and 24.19.0 jobs passed installation, all 13 tests and compilation. The Linux splash-smoke job passed on Electron 41.10.3, embedded Node 24.18.0, including document load, buffered/latest progress updates, literal markup text, no renderer require, and native-window closure. Xvfb/--no-sandbox limits still apply; this is not full-application or sandbox-enforcement evidence.

Local integration: apply exact #63 ca5b890a4fe010065a76294506abbde0b293ec3c to exact #70 99feb3319e35a896bbdb4505a02a9fa452380329, then this patch. Root npm ci --ignore-scripts --no-audit --no-fund, all 13 tests and npm run electron:build pass with Electron 41.10.6 / patched Axios and Undici. This local combination is not the head of either dependency PR.

SonarCloud analysis 111231455295 is successful on the same head. The green gate does not establish full-app/runtime security acceptance or closure of every alert.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud