Harden main window navigation and permissions (sec #7)

The main window guarded will-navigate but not will-redirect, and left
the default session's permission handler at allow — looser than the
provider sign-in windows. Gate redirects with the same off-origin check
and deny every permission request/check by default. The first-party
renderer requests no web permissions, so denial changes nothing it does
while removing the grant a compromised page would otherwise inherit.
Verified end to end.

AgentCompany-New/src/main/app/window-security.ts

@@ -2,9 +2,16 @@ import type { BrowserWindow } from "electron";
 
 export function attachMainWindowSecurity(win: BrowserWindow, devServerOrigin: string | null): void {
   win.webContents.setWindowOpenHandler(() => ({ action: "deny" }));
-  win.webContents.on("will-navigate", (event, url) => {
+  const blockNavigation = (event: Electron.Event, url: string): void => {
     if (devServerOrigin && url.startsWith(devServerOrigin)) return;
     if (url.startsWith("file://")) return;
     event.preventDefault();
-  });
+  };
+  win.webContents.on("will-navigate", blockNavigation);
+  win.webContents.on("will-redirect", blockNavigation);
+  // The first-party renderer never asks for camera, microphone, geolocation,
+  // notifications, and the like, so deny every permission outright — matching
+  // the provider sign-in windows — rather than leaving the default allow.
+  win.webContents.session.setPermissionRequestHandler((_webContents, _permission, callback) => callback(false));
+  win.webContents.session.setPermissionCheckHandler(() => false);
 }