Security patch release completing the nontechnical onboarding rollout. Adds production HTTP security headers while retaining the guided setup experience, signed CEP package, Claude Desktop MCP bundle, and direct-install UXP CCX. Native Windows and macOS installer previews pass CI but remain unpublished until trusted platform signing credentials are configured.