fix(security): enforce Mermaid media and desktop credential boundaries - #3501

Mermaid HTML labels could request remote images during layout, before the final SVG sanitizer or Markdown media controls ran. Desktop could also reuse an authenticated file-mode backend despite requiring OS credential storage.

Apply an immutable pre-layout label allowlist and protect resource-bearing Mermaid configuration. Keep ordinary diagrams, formatting and safe MathML semantics; image-shaped nodes retain their explicit refusal. Desktop now requires the live authenticated owner proof to confirm OS storage before both early reuse and startup polling, with an explicit startup error for file, missing or invalid modes. Existing servers and credentials remain untouched.

Validation

• Baseline reproductions: real Chromium observed loopback image requests from labels, CSS/font configuration, image inputs, table backgrounds and SVG filters; the baseline launcher accepted authenticated file-mode proof. The fixed paths prevent those requests and reject incompatible attachment.
• Actual PresentedAgentMarkdown controlled-network tests, streaming and separately activated Markdown media: passed. The browser suite passed 17 tests, including direct production-runtime MathML semantics/layout controls. Initial fixture-build timeout under concurrent load was resolved by a temporary startup-timeout increase; application code and assertions were unchanged.
• Authenticated runtime-control and actual Node subprocess tests cover compatible self-start/reuse, incompatible early reuse, and a simulated competing winner becoming visible during polling. Credential read/write tests preserve the existing mode rules. This is not a simultaneous two-backend race test.
• Node, sandbox and Web typechecks passed; full lint passed before the MathML-only follow-up, with final Web typecheck and targeted lint passing afterward. i18n/module guards passed (845 tests); Mermaid unit tests passed (6 tests).
• Final exact-head affected suite: node scripts/ci/module-test-impact.mjs affected --base 94158f30c7fb35e8baa18d13dc1f7dbe7bb52436 --head f3141274cded0748d6438acb683f10c137a29391 -- --maxWorkers=4 passed with exit 0: 1,066 files / 24,821 tests passed; 56 files / 3,321 tests skipped. It selected the desktop composition and renderer Streamdown modules plus registered consumers.

Independent security reviews identified additional image-fetch paths and a MathML compatibility regression; both were fixed and the final review found no actionable blockers. No task-specific evidence reports are committed.

Scope and limits

Browser execution used real Chromium on macOS. Packaged Electron and real Linux/Windows credential-vault end-to-end checks are not claimed. MathML controls use the production runtime directly because the existing Markdown normalizer collapses $$ replacement tokens; that separate behavior is unchanged. Security negative tests use the actual Markdown surface.

Formal security/runtime documentation describes the resulting behavior. Documentation-only PR #3498 edits the same paragraphs; integrate its other corrections while retaining this PR's final media and credential-mode policy. The separately checked local integration resolves that overlap; this branch keeps its scoped diff. Documentation corrections and UI consistency work remain separate PRs.

CI follow-up: registered the runtime-control integration test as a settings_operations consumer after the remote static guard identified the missing edge. Consumer coverage and all 254 ownership/validation checks pass; the final affected plan adds 17 files, whose 136 tests pass. Initial local guard execution hit three 15-second timeouts under host load; the serial retry passed. This follow-up changes only test-impact metadata.