feat: improve terminal and markdown link behavior - #2

…ick-launch profiles, winget) + bump 0.8.6

#1 Notification sounds: ship a default chime and play it on every notification
   fire, gated on notificationPrefs.sound. Main signals notification:play-sound;
   a single renderer listener (initNotificationSound) plays the bundled WAV.

#3 wmux browser new-instance bug: add app.requestSingleInstanceLock() with a
   second-instance focus handler so a stray `wmux ...` launch focuses the running
   window instead of spawning a new one (named WMUX_INSTANCE isolates userData so
   dev/prod still coexist). Rebuild resources/cli/wmux.js so the shipped CLI honors
   WMUX_PIPE again.

#4 Quick-launch profiles in the + caret dropdown: {name,icon,type,shell,cwd,
   startupCommands,url} model, global profiles in settings (with a Profiles panel
   + Windows Terminal profile import) and project-level .wmux.json. PTY startup
   commands run once on fresh creation; relative cwd resolves against the workspace.

#2 Winget: manifest set + auto-publish workflow (portable-zip install, no signing).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Addresses the critical/high findings from the security review:

- Pipe auth (#1): privileged V2 methods now require a per-instance token
  (crypto.randomBytes, 0600 file in APPDATA, timing-safe compare). Public
  telemetry methods stay open via an allowlist so detection/hooks keep
  working. Token injected into spawned shells as WMUX_PIPE_TOKEN; CLI and
  hook clients read it from env or the token file.
- CDP proxy (#2): reject DNS-rebinding via a loopback-only Host allowlist
  (HTTP 403 + WS verifyClient) AND a browser-Origin guard on the WS upgrade
  (WebSockets bypass CORS, so a passing Host alone lets a malicious page
  open ws://127.0.0.1:9222 and reach Runtime.evaluate). Absent Origin is
  allowed so chrome-devtools-mcp/puppeteer/native ws clients still connect.
- Markdown XSS (#3): sanitize marked output with DOMPurify before
  dangerouslySetInnerHTML in the privileged renderer.
- markdown.load_file: extension allowlist + 5MB cap + isFile check so a
  pipe caller can't slurp arbitrary secrets into the viewer.
- Webview hardening (#9): central web-contents-created handler strips
  preload/nodeIntegration from webviews, routes window.open to the OS
  browser, and blocks the main window from navigating off its own UI.

Tests: pipe-server token auth (9) + new cdp-proxy host/origin guard (9).