fix: harden the Electron 43 release runtime

Upgrade Electron, electron-builder, and electron-updater to patched versions, align the supported Node.js toolchain, and preserve secure file drops through the context-isolated webUtils bridge.

Cover the Electron 43 file-path migration with a real temporary-file drag-and-drop regression test and retain zero-vulnerability lockfile resolution.

src/renderer-streamers.ts

@@ -402,8 +402,7 @@ function initCutterDragDrop(): void {
         // First video-ish file wins
         const allowed = /\.(mp4|mkv|ts|mov|avi)$/i;
         const file = files.find((f) => allowed.test(f.name)) || files[0];
-        // Electron extends File with .path even with contextIsolation:true
-        const filePath = (file as unknown as { path?: string }).path || '';
+        const filePath = window.api.getPathForFile(file);
         if (!filePath) return;
 
         const loader = (window as unknown as { loadCutterFromPath?: (p: string) => Promise<void> }).loadCutterFromPath;