fix: harden Windows installer and dependency toolchain

[numnx]

What changed

• Upgrade Electron Builder to 26.15.6 and opt into NSIS 3.12 while retaining windows-latest for every Windows lane.
• Isolate Electron Builder's checksum-pinned custom NSIS plugins from the compiler's standard plugin directory, preventing native Windows duplicate-command failures.
• Require the Windows installed-app smoke to succeed on its first attempt; removed access-violation retry masking.
• Harden pnpm 11 packaging by updating to pnpm 11.13.1, explicitly declaring build-time tslib, validating packaged runtime imports, and preserving direct runtime dependencies including zod.
• Refresh compatible runtime, Electron, dashboard, test, and container toolchain dependencies; align Node typings with the supported Node 22 runtime.
• Pin every GitHub Action to an immutable release commit, add Dependabot coverage for npm/Actions/Docker, and enforce the dependency age/build-script policies.
• Update managed runtime images and packaging documentation, and replace removed Lucide git-host exports with local reusable icons.

Why

The Windows per-user NSIS installer could terminate with 0xC0000005, and pnpm 11's stricter dependency layout exposed packages that were previously available only through incidental hoisting, including the installed desktop zod failure. The release pipeline also retried the Windows crash, which could hide a broken first installation attempt.

After the initial toolchain upgrade, native Windows packaging exposed a second integration issue: Electron Builder and NSIS both searched the same standard plugin directory, so makensis rejected duplicate nsDialogs and System commands. The final configuration keeps NSIS 3.12 as the compiler and standard-plugin source while loading only Electron Builder's additional plugins from a separate checksum-pinned archive.

Validation

• pnpm run ci — passed
  • backend coverage: 6,154 passed, 12 skipped
  • dashboard: 2,537 passed, 1 skipped
  • security audit: 0 vulnerabilities
• pnpm run test:e2e — 74 passed
• pnpm run test:orchestration:rapid — 292 passed, 7 skipped
• pnpm run test:orchestration:ci-dag — passed with four merged tasks, QA follow-up repair, two forced runtime restarts, and complete workspace cleanup
• npm tarball install smoke — passed, including ONNX and CLI startup
• Linux Electron package build — passed for AppImage, tar.gz, and .deb
• Extracted .deb packaged-app startup smoke — renderer-ready and clean exit
• Managed runtime Docker base/browser builds — passed; pinned Node/npm/pnpm/Bun/Playwright tools execute offline
• Workflow YAML/action-pin audit — all workflows parse; all 118 action refs are immutable SHAs with matching release comments
• Peer dependency audit — no issues
• Dependency audit — 0 vulnerabilities across 809 packages
• Native Release Candidate Diagnostics — passed on the final commit:
  • Linux: package, install, and installed-app launch passed
  • macOS: package, install, and installed-app launch passed
  • Windows (windows-latest): NSIS package, first-attempt install, and installed-app launch passed

Risk and rollback

This intentionally includes the compatible dependency refresh needed for the 0.9.10 toolchain, including Electron and native ONNX updates. The final three-OS native package/install/start gate passed on commit b28774140e925186536c2359e929afd827ea7cc5. Rollback is a revert of this PR; no database or persistent-state migration is included.