The Windows installer was tripping SentinelOne / Defender false positives
because PyInstaller's bootloader signature is on most AV malware lists.
Switching the launcher build to Nuitka (compiles to native C, no shared
bootloader) brings the VirusTotal detection ratio from N/74 down to 1/74
(only DeepInstinct, a known high-FP AI engine).

Mac build is unchanged — still PyInstaller + create-dmg.