Electron hardening: sandbox, navigation guard, CSP

[rebaserHEAD]

The shell already has the big ones right (contextIsolation on, nodeIntegration off, window-open handler routes external links to the system browser). Three standard hardening items are missing:

• sandbox: true on the BrowserWindow. The preload only uses contextBridge/ipcRenderer, which are available in sandboxed preloads, so this should be a config flip plus a smoke test.
• will-navigate guard in main: in-page navigation is currently unguarded, and Chromium''s default behavior for a file dropped on the window is to NAVIGATE to it, which replaces the whole app with the file contents. The guard is the backstop; proper drop handling is Drag and drop a .yml onto the window to open it #53.
• CSP for the packaged app:// build (meta tag or protocol response header): the app is fully self-contained, so a tight default-src ''self'' policy should cost nothing.

None of these change behavior for legitimate use; they cap the blast radius of anything unexpected in parsed fork content.