ci: add Windows quality and packaging gates

Teach ESLint the classic renderer and mixed CommonJS harness runtimes while retaining actionable rules. Add deterministic credential, lockfile, release-manifest, and lint contracts plus equivalent GitHub and Gitea Windows pipelines. Gate clean installs, focused offline smoke coverage, builds, packaged launches, and silent installer verification without enabling authenticated network tests.

src/main/domain/integrity-check.ts

@@ -62,7 +62,7 @@ export function parseFfprobeJson(rawJson: string): ProbeResult {
     try {
         parsed = JSON.parse(rawJson) as FfprobeJson;
     } catch (e) {
-        throw new Error(`integrity-check: ffprobe JSON parse failed: ${e instanceof Error ? e.message : String(e)}`);
+        throw new Error(`integrity-check: ffprobe JSON parse failed: ${e instanceof Error ? e.message : String(e)}`, { cause: e });
     }
 
     const streams: ProbeStream[] = (parsed.streams ?? []).map((s, idx) => ({

src/main/domain/managed-tools.ts

@@ -197,8 +197,7 @@ export class ManagedToolInstaller {
         const existing = this.inFlight.get(manifest.id);
         if (existing) return existing;
 
-        let operation!: Promise<ManagedToolInstallResult>;
-        operation = Promise.resolve()
+        const operation = Promise.resolve()
             .then(() => this.installOnce(manifest))
             .catch(async (error: unknown) => await this.failure(manifest, 'download-failed', this.errorText(error), []))
             .finally(() => {

src/main/domain/secret-input.test.ts

@@ -22,7 +22,7 @@ describe('resolveSecretInputUpdate', () => {
         const revision = createSecretInputRevision();
         const requestRevision = revision.current();
         let resolveSave: (() => void) | undefined;
-        let visibleValue = 'first-secret';
+        let visibleValue: string;
         const save = new Promise<void>((resolve) => {
             resolveSave = resolve;
         }).then(() => {

src/main/domain/top-clips-crawler.ts

@@ -107,7 +107,7 @@ export async function fetchTopClips(opts: FetchTopClipsOptions): Promise<TopClip
     try {
         parsed = JSON.parse(text) as HelixClipsResponse;
     } catch (e) {
-        throw new Error(`top-clips-crawler: parse failed: ${e instanceof Error ? e.message : String(e)}`);
+        throw new Error(`top-clips-crawler: parse failed: ${e instanceof Error ? e.message : String(e)}`, { cause: e });
     }
 
     const rows = parsed.data ?? [];

src/main/infra/format-helpers.ts

@@ -1,7 +1,6 @@
 // Pure-Format-Helpers, extrahiert aus main.ts. Keine Globals, keine I/O.
 
-const FILENAME_INVALID_RE = /[<>:"|?*\x00-\x1f]/g;
-const FILENAME_PATH_SEP_RE = /[\\/]/g;
+const FILENAME_INVALID_CHARACTERS = new Set('<>:"|?*\\/');
 
 /**
  * Entfernt Windows-Filesystem-verbotene Zeichen und Pfad-Separatoren aus einem
@@ -9,9 +8,9 @@ const FILENAME_PATH_SEP_RE = /[\\/]/g;
  * nichts uebrig bleibt.
  */
 export function sanitizeFilenamePart(input: string, fallback = 'unnamed'): string {
-    const cleaned = (input || '')
-        .replace(FILENAME_INVALID_RE, '_')
-        .replace(FILENAME_PATH_SEP_RE, '_')
+    const cleaned = Array.from(input || '', (character) => {
+        return character.charCodeAt(0) < 32 || FILENAME_INVALID_CHARACTERS.has(character) ? '_' : character;
+    }).join('')
         .trim();
     return cleaned || fallback;
 }