[CodingDiego]

Fixes the findings of the pre-1.0 security review of the desktop helper, install and scripts (#60), and the eight low-severity findings of the review of this diff. Changes are under Unreleased in the changelog; the crate version stays 1.0.0-rc.2.

Changes

• Desktop helper. The desktop list must belong to the shell's process, not only carry its class names (is_desktop_list). List reads use SendMessageTimeoutW; the timed read runs before any COM call into Explorer, and a menu request older than two seconds is dropped. Delete compares the selection item by item with the menu's items. A right-drag replay overtaken by the user's release no longer leaves the button down, and a stale swallowed key is cleared.
• Install. --register registers the installed copy and refuses, in both languages, when there is none. revert and scripts/restore-explorer.ps1 delete a recorded file only when its name is ours and its folder is the install, Programs or Startup folder, and a registry value or key only under the keys rexplorer writes. scripts/install.ps1 no longer builds from source inside a release zip.
• Home. The shell's drag image request is answered once, for the window that started the drag, during that drag.
• Crash marker. A clean exit removes its .seh file as the last step of main, so the crash folder only fills on real crashes.
• Mailbox. Mailbox::post_while lets a worker take its payload back when the window is gone, which closes a bitmap leak on destroy in Home icons and thumbnails.
• Session file. active= counts among the tabs actually written.
• Recycle Bin. An item inside a recycled folder is treated as in the bin for the packaged-app commands.
• Tests. Shell dialog tests are serialized and only answer dialogs that appeared after they started; the forged desktop window in the test is message-only; files put in the real Recycle Bin by a test are restored on every exit path.
• SECURITY.md names the review's findings and what was fixed, and states what still has no timeout.

How it was tested

• cargo build --release --locked --all-targets with -D warnings, cargo test --release --locked three times (app 272, core 256, data_ops 11), cargo clippy --workspace --all-targets --locked -- -D warnings.
• scripts\smoke.ps1 -Hosted on a copy of the release exe: 31 PASS, 8 SKIP, 0 FAIL, including install-scratch, install-scripts and crash-recovery.
• A security review of the diff found nothing critical or high and eight low findings; all eight are fixed here with tests.

Not done

• No real input was used. The desktop helper's menu, the right-drag replay and a real drag from a Home tile were not driven on a live desktop; a real install, register, unregister and uninstall round on a user profile is still to run (Distribution: Upgrade path #64, Distribution: Uninstall restores Explorer completely #65).
• The one-request drag image grant assumes the shell asks once per drag; not checked live.
• The later COM calls into Explorer (finding the view, building and running the menu) still have no timeout; SECURITY.md says so.
• Other mailbox users were not checked for the post-after-destroy race.

Issues

Closes #60.

Progress on #84. Tracking: #71.