feat(lock): main-window lock screen; harden env gating, sandbox and ssh teardown

Lock screen (main-window overlay, no second window):
- scrypt password verifier in <userData>/lock.json (per-write salt,
  timingSafeEqual); salt/hash/password never leave the main process
- lock now / idle auto-lock / lock at startup, growing failure cooldown,
  lock flags persisted so a quit-and-relaunch cannot bypass the lock
- locked shell and body portals go inert while sessions keep running;
  menu accelerators (reload, DevTools, zoom) are swallowed while locked
- settings gains a Lock tab; all copy in zh-CN/zh-TW/en/ja

Security and stability:
- packaged builds ignore ELECTRON_RENDERER_URL / OT_UPDATE_URL (devEnv)
- renderer preload runs with sandbox: true
- unreadable known_hosts store fails closed instead of being overwritten
- connect-time secrets gated by the bookmark's auth method (connectPromptFor)
- ssh stream teardown is idempotent: PTY_EXIT broadcasts exactly once
- sysinfo polling is refcounted for split panes (forceStopPolling on close)
- session-log index entries are path-contained; settings store writes
  atomically with EPERM/EBUSY retry
- sync-changelog tolerates CRLF checkouts (was a silent no-op)
- retry ssh2 host-key generation (flaky malformed key, ~1/500)

Tests: lock-store + lock-controller suites; transport-death PTY_EXIT e2e;
GitHub Actions CI (typecheck + 10 offline tests + build)

src/shared/ipc.ts

@@ -110,9 +110,60 @@ export const Ipc = {
   /** normalize a cwd reported by the shell (OSC 7 / OSC 9;9) */
   CWD_REPORT: 'session:cwdReport',
   /** open a local directory in the OS file manager (terminal toolbar) */
-  CWD_OPEN: 'session:cwdOpen'
+  CWD_OPEN: 'session:cwdOpen',
+
+  // ---- lock screen (main-window overlay; the main process owns the state) ----
+  /** renderer pulls the current lock state without changing it */
+  LOCK_STATE_GET: 'lock:stateGet',
+  /** set or replace the password; an existing one must be verified first */
+  LOCK_SET_PASSWORD: 'lock:setPassword',
+  /** remove the password; the existing one must be verified first */
+  LOCK_CLEAR_PASSWORD: 'lock:clearPassword',
+  LOCK_UNLOCK: 'lock:unlock',
+  LOCK_NOW: 'lock:now',
+  /** main -> renderer broadcast: LockSettingsState */
+  LOCK_STATE_CHANGED: 'lock:state'
 } as const
 
+/**
+ * The lock state the renderer sees. Deliberately free of salt, hash and
+ * password: the stored verifier never leaves the main process.
+ */
+export interface LockSettingsState {
+  /** a password is set, so the lock can engage at all */
+  configured: boolean
+  enabled: boolean
+  autoLockMinutes: number
+  lockAtStartup: boolean
+  locked: boolean
+  /** remaining lockout in ms; absent while no cooldown is running */
+  cooldownMs?: number
+}
+
+/** Passwords travel one way only: in. Neither field is ever echoed back. */
+export interface LockPasswordInput {
+  /** required when a password is already set (replace / clear) */
+  currentPassword?: string
+  /** required when setting or replacing */
+  newPassword?: string
+}
+
+export type LockOperationError =
+  /** the offered new password is unusable (empty, too short, too long) */
+  | 'invalid-password'
+  /** the offered current password does not match */
+  | 'wrong-password'
+  /** too many failed attempts: retry after state.cooldownMs */
+  | 'cooldown'
+  /** the verifier could not be written to disk */
+  | 'save-failed'
+
+export interface LockOperationResult {
+  ok: boolean
+  state: LockSettingsState
+  error?: LockOperationError
+}
+
 export interface PtyCreateOptions {
   cwd?: string
   /** executable; omit for platform default shell */