Tighten JRE/runtime handling and jlink safety.
- frontend/editor/scripts/verify-bundled-jre.mjs: import path.resolve, compute expected release path (src-tauri/runtime/jre/release) and refuse to read any unexpected release file path to avoid accidental/malicious file reads.
- scripts/build-jlink-runtime.ps1: add an allowed jlink module whitelist, sanitize/split the $Modules input, require at least one module, validate requested modules against the whitelist, and pass a safe ModulesArg to --add-modules to prevent injection or unsupported modules.
Ludy87
ca739e14b0