DLSSync v1.6.9

The integrity-hardening release. This is the public v1.6.9 line for the v1.6.8 mouse side-button navigation polish plus the security/integrity follow-up: it closes the active esbuild Dependabot advisory without forcing a risky frontend framework migration, restores the generated manifest/schema contract that was breaking the hourly DLSSync-Manifest pipeline, and tightens the release docs around the signed catalog path.

Added

• Shipped the v1.6.8 mouse side-button navigation polish in the public v1.6.9 build: button 3 moves back through DLSSync app state and button 4 restores the next state when one exists.

Security

• Forced the transitive esbuild toolchain dependency to 0.28.1, the patched line for GHSA-gv7w-rqvm-qjhr, through the root package.json pnpm override instead of leaving Vite/Vitest on a vulnerable binary resolver.
• Kept the signed manifest contract strict: empty dynamic anti-cheat binary rows are no longer serialized into the generated public catalog, preventing schema drift from breaking the manifest publisher.

Changed

• Release metadata, README, docs, and test index now point at v1.6.9 as the current security/integrity line.
• The production frontend build now targets the Tauri WebView2 baseline directly instead of falling back to Safari when TAURI_PLATFORM is absent.
• The anti-cheat docs now document how optional manifest binary signatures layer over the static detector without emitting an empty field.

Fixed

• The hourly DLSSync-Manifest workflow no longer receives a generated anti_cheat_binaries: [] field that the public schema rejects.
• Patched esbuild no longer tries to downlevel the Svelte runtime to an irrelevant Safari target during standalone frontend builds.