feat(lock): main-window lock screen; harden env gating, sandbox and ssh teardown

Lock screen (main-window overlay, no second window):
- scrypt password verifier in <userData>/lock.json (per-write salt,
  timingSafeEqual); salt/hash/password never leave the main process
- lock now / idle auto-lock / lock at startup, growing failure cooldown,
  lock flags persisted so a quit-and-relaunch cannot bypass the lock
- locked shell and body portals go inert while sessions keep running;
  menu accelerators (reload, DevTools, zoom) are swallowed while locked
- settings gains a Lock tab; all copy in zh-CN/zh-TW/en/ja

Security and stability:
- packaged builds ignore ELECTRON_RENDERER_URL / OT_UPDATE_URL (devEnv)
- renderer preload runs with sandbox: true
- unreadable known_hosts store fails closed instead of being overwritten
- connect-time secrets gated by the bookmark's auth method (connectPromptFor)
- ssh stream teardown is idempotent: PTY_EXIT broadcasts exactly once
- sysinfo polling is refcounted for split panes (forceStopPolling on close)
- session-log index entries are path-contained; settings store writes
  atomically with EPERM/EBUSY retry
- sync-changelog tolerates CRLF checkouts (was a silent no-op)
- retry ssh2 host-key generation (flaky malformed key, ~1/500)

Tests: lock-store + lock-controller suites; transport-death PTY_EXIT e2e;
GitHub Actions CI (typecheck + 10 offline tests + build)

src/shared/i18n/dicts/zh-CN/settings.ts

@@ -7,6 +7,7 @@ const settings: Record<string, string> = {
   'settings.tabs.highlight': '高亮',
   'settings.tabs.theme': '主题',
   'settings.tabs.system': '系统',
+  'settings.tabs.lock': '锁屏',
   'settings.tabs.about': '关于',
   'settings.resizeHandle': '拖拽调整大小',
   'settings.preview': '预览',
@@ -94,6 +95,49 @@ const settings: Record<string, string> = {
   'settings.system.shortcutPlaceholder': '点击后按下快捷键，留空禁用',
   'settings.system.shortcutConflict':
     '该组合键已被应用内快捷键占用（Ctrl+= / Ctrl+- / Ctrl+0 / Ctrl+PgUp / Ctrl+PgDn），请换一个。',
+  'settings.lock.password.title': '锁屏密码',
+  'settings.lock.password.desc': '设置密码后才能启用锁屏',
+  'settings.lock.password.configured': '已配置',
+  'settings.lock.password.notConfigured': '未配置',
+  'settings.lock.password.current': '当前密码',
+  'settings.lock.password.currentPlaceholder': '请输入当前密码',
+  'settings.lock.password.new': '新密码',
+  'settings.lock.password.newPlaceholder': '请输入新密码',
+  'settings.lock.password.confirm': '确认新密码',
+  'settings.lock.password.confirmPlaceholder': '再次输入新密码',
+  'settings.lock.password.set': '设置密码',
+  'settings.lock.password.change': '修改密码',
+  'settings.lock.password.clear': '清除密码',
+  'settings.lock.password.clearTitle': '清除锁屏密码？',
+  'settings.lock.password.clearDesc': '清除后锁屏会一并关闭，需要当前密码确认。',
+  'settings.lock.password.mismatch': '两次输入的新密码不一致',
+  'settings.lock.password.empty': '请填写密码',
+  'settings.lock.password.saved': '密码已保存',
+  'settings.lock.password.cleared': '锁屏密码已清除',
+  'settings.lock.password.forgot':
+    '忘记锁屏密码无法通过云端找回，也没有后门：只能删除本机锁屏数据后重新设置。',
+  'settings.lock.enabled': '启用锁屏',
+  'settings.lock.enabledDesc': '闲置或启动时锁定主窗口，解锁需要上面的密码',
+  'settings.lock.needPassword': '请先设置锁屏密码',
+  'settings.lock.autoLock': '闲置自动锁屏',
+  'settings.lock.autoLockDesc': '系统闲置超过该时长后自动锁定（0 表示从不）',
+  'settings.lock.autoLockOff': '关闭',
+  'settings.lock.autoLockMinutes': '{n} 分钟',
+  'settings.lock.lockAtStartup': '启动时锁屏',
+  'settings.lock.lockAtStartupDesc': '每次启动后先要求输入密码',
+  'settings.lock.lockNow': '立即锁屏',
+  'settings.lock.lockNowDesc': '马上锁定主窗口（会话保持运行）',
+  'settings.lock.title': '已锁定',
+  'settings.lock.screenDesc': '输入锁屏密码解锁',
+  'settings.lock.passwordPlaceholder': '密码',
+  'settings.lock.unlock': '解锁',
+  'settings.lock.unlocking': '解锁中…',
+  'settings.lock.screenForgot': '忘记密码？锁屏密码无法找回，只能删除本机锁屏数据。',
+  'settings.lock.error.invalidPassword': '密码无效（不能为空或过短）',
+  'settings.lock.error.wrongPassword': '密码错误',
+  'settings.lock.error.cooldown': '尝试次数过多，请等待 {n} 秒后重试',
+  'settings.lock.error.cooldownGeneric': '尝试次数过多，请稍后再试',
+  'settings.lock.error.saveFailed': '保存失败，请重试',
   'settings.resetTerminal': '恢复默认终端设置',
   'settings.resetTerminalTitle': '恢复默认终端设置？',
   'settings.resetTerminalDesc': '字体、光标、渲染与主题等全部终端设置将恢复为默认值。',