fix(startup): allow case-insensitive renderer paths on Windows

Normalizes local renderer file URLs to filesystem paths before comparison so Windows path casing cannot block the packaged application during initial navigation. Adds a regression test covering case-insensitive packaged renderer URLs and records the v2.0.27 release notes.

src/main/browser-security.ts

@@ -1,3 +1,5 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { shell, type WebPreferences } from "electron";
 
 export type HttpsHostRule = {
@@ -144,7 +146,14 @@ function isExpectedRendererUrl(rawUrl: string, expectedUrl: string): boolean {
     const parsed = new URL(String(rawUrl || ""));
     const expected = new URL(String(expectedUrl || ""));
     if (expected.protocol === "file:") {
-      return parsed.protocol === "file:" && parsed.host === expected.host && parsed.pathname === expected.pathname;
+      if (parsed.protocol !== "file:") {
+        return false;
+      }
+      const actualPath = path.resolve(fileURLToPath(parsed));
+      const expectedPath = path.resolve(fileURLToPath(expected));
+      return process.platform === "win32"
+        ? actualPath.toLowerCase() === expectedPath.toLowerCase()
+        : actualPath === expectedPath;
     }
     return parsed.origin === expected.origin;
   } catch {