Buffer startup drops until renderer readiness

Keep a bounded FIFO of drop payloads while the startup or recovery document is not validated. Flush each payload exactly once only after the generation-checked renderer Ready signal, retain immediate delivery for a ready renderer, and discard stale payloads when the main window is destroyed or replaced.

Wire renderer block, Ready, and window-close transitions through main and cover recovery, safe failure visibility, stale Ready signals, ordered multi-drop delivery, queue bounds, lifecycle cleanup, and duplicate prevention.

main.js

@@ -1458,6 +1458,7 @@ function createWindow() {
   clearCloseFlushTimer();
   const currentStartupRevealGate = createStartupRevealGate(mainWindow, {
     onBlock: () => {
+      startupExternalRevealBindings.rendererBlocked(startupWindow.window);
       closeHandshakeReady = false;
       restoreClosePreparation(closePreparationAttempt);
     }
@@ -1525,6 +1526,7 @@ function createWindow() {
       debugLog(`RENDER PROCESS GONE: reason=${details.reason} exitCode=${details.exitCode}`);
     },
     onReady: () => {
+      startupExternalRevealBindings.rendererReady(startupWindow.window);
       closeHandshakeReady = true;
     },
     onInitializationFailed: (details) => {
@@ -1536,6 +1538,7 @@ function createWindow() {
   const currentStartupRendererHandlers = startupRendererHandlers;
   const currentStartupRecoveryCoordinator = startupRecoveryCoordinator;
   mainWindow.once('closed', () => {
+    startupExternalRevealBindings.windowClosed(startupWindow.window);
     currentStartupRendererHandlers.dispose();
     if (startupRevealGate === currentStartupRevealGate) startupRevealGate = null;
     if (startupRendererHandlers === currentStartupRendererHandlers) startupRendererHandlers = null;