feat(lock): main-window lock screen; harden env gating, sandbox and ssh teardown

Lock screen (main-window overlay, no second window):
- scrypt password verifier in <userData>/lock.json (per-write salt,
  timingSafeEqual); salt/hash/password never leave the main process
- lock now / idle auto-lock / lock at startup, growing failure cooldown,
  lock flags persisted so a quit-and-relaunch cannot bypass the lock
- locked shell and body portals go inert while sessions keep running;
  menu accelerators (reload, DevTools, zoom) are swallowed while locked
- settings gains a Lock tab; all copy in zh-CN/zh-TW/en/ja

Security and stability:
- packaged builds ignore ELECTRON_RENDERER_URL / OT_UPDATE_URL (devEnv)
- renderer preload runs with sandbox: true
- unreadable known_hosts store fails closed instead of being overwritten
- connect-time secrets gated by the bookmark's auth method (connectPromptFor)
- ssh stream teardown is idempotent: PTY_EXIT broadcasts exactly once
- sysinfo polling is refcounted for split panes (forceStopPolling on close)
- session-log index entries are path-contained; settings store writes
  atomically with EPERM/EBUSY retry
- sync-changelog tolerates CRLF checkouts (was a silent no-op)
- retry ssh2 host-key generation (flaky malformed key, ~1/500)

Tests: lock-store + lock-controller suites; transport-death PTY_EXIT e2e;
GitHub Actions CI (typecheck + 10 offline tests + build)

src/shared/i18n/dicts/en/settings.ts

@@ -7,6 +7,7 @@ const settings: Record<string, string> = {
   'settings.tabs.highlight': 'Highlighting',
   'settings.tabs.theme': 'Themes',
   'settings.tabs.system': 'System',
+  'settings.tabs.lock': 'Lock',
   'settings.tabs.about': 'About',
   'settings.resizeHandle': 'Drag to resize',
   'settings.preview': 'Preview',
@@ -100,6 +101,52 @@ const settings: Record<string, string> = {
   'settings.system.shortcutPlaceholder': 'Click and press a shortcut, leave empty to disable',
   'settings.system.shortcutConflict':
     'This shortcut is already used by the app (Ctrl+= / Ctrl+- / Ctrl+0 / Ctrl+PgUp / Ctrl+PgDn). Please choose another.',
+  'settings.lock.password.title': 'Lock password',
+  'settings.lock.password.desc': 'A password is required before the lock can be enabled',
+  'settings.lock.password.configured': 'Set',
+  'settings.lock.password.notConfigured': 'Not set',
+  'settings.lock.password.current': 'Current password',
+  'settings.lock.password.currentPlaceholder': 'Enter the current password',
+  'settings.lock.password.new': 'New password',
+  'settings.lock.password.newPlaceholder': 'Enter a new password',
+  'settings.lock.password.confirm': 'Confirm new password',
+  'settings.lock.password.confirmPlaceholder': 'Repeat the new password',
+  'settings.lock.password.set': 'Set password',
+  'settings.lock.password.change': 'Change password',
+  'settings.lock.password.clear': 'Remove password',
+  'settings.lock.password.clearTitle': 'Remove the lock password?',
+  'settings.lock.password.clearDesc':
+    'The lock is turned off along with it. The current password is required to confirm.',
+  'settings.lock.password.mismatch': 'The two new passwords do not match',
+  'settings.lock.password.empty': 'Enter a password',
+  'settings.lock.password.saved': 'Password saved',
+  'settings.lock.password.cleared': 'Lock password removed',
+  'settings.lock.password.forgot':
+    'A forgotten lock password cannot be recovered from any cloud or backdoor: the only way back in is deleting this machine\u2019s lock data and setting a new one.',
+  'settings.lock.enabled': 'Enable lock',
+  'settings.lock.enabledDesc':
+    'Lock the main window when idle or at startup; unlocking needs the password above',
+  'settings.lock.needPassword': 'Set a lock password first',
+  'settings.lock.autoLock': 'Lock when idle',
+  'settings.lock.autoLockDesc': 'Lock once the system has been idle this long (0 = never)',
+  'settings.lock.autoLockOff': 'Off',
+  'settings.lock.autoLockMinutes': '{n} min',
+  'settings.lock.lockAtStartup': 'Lock at startup',
+  'settings.lock.lockAtStartupDesc': 'Ask for the password right after every launch',
+  'settings.lock.lockNow': 'Lock now',
+  'settings.lock.lockNowDesc': 'Lock the main window immediately (sessions keep running)',
+  'settings.lock.title': 'Locked',
+  'settings.lock.screenDesc': 'Enter the lock password to unlock',
+  'settings.lock.passwordPlaceholder': 'Password',
+  'settings.lock.unlock': 'Unlock',
+  'settings.lock.unlocking': 'Unlocking…',
+  'settings.lock.screenForgot':
+    'Forgot it? The lock password cannot be recovered \u2014 the only way out is deleting this machine\u2019s lock data.',
+  'settings.lock.error.invalidPassword': 'Password is invalid (empty or too short)',
+  'settings.lock.error.wrongPassword': 'Wrong password',
+  'settings.lock.error.cooldown': 'Too many attempts \u2014 try again in {n}s',
+  'settings.lock.error.cooldownGeneric': 'Too many attempts \u2014 try again later',
+  'settings.lock.error.saveFailed': 'Save failed, please retry',
   'settings.resetTerminal': 'Reset terminal settings',
   'settings.resetTerminalTitle': 'Reset terminal settings?',
   'settings.resetTerminalDesc': 'All terminal settings — font, cursor, rendering and theme — will be restored to defaults.',