fix: production-ready build pipeline + audit_device() crash

- fingerprint.py: audit_device() crashed with "cannot unpack non-iterable
  bool" because of a stray `webrtc_ok, _ = ... and True or False` line.
  Replaced with a proper Chrome+Edge registry probe using _WEBRTC_*
  module constants.

- ProxyChainManager.spec: removed the hardcoded absolute run.py path,
  resolve everything relative to SPECPATH so the spec is portable on any
  machine / CI runner. Bundled signup_extension/ and world_map.png as
  data files (these were missing — the runtime would fall back to drawn
  landmasses and the signup browser extension would 404 in the frozen
  build). Added PIL._tkinter_finder hidden import for safety.

- scripts/setup_and_build.ps1: build now uses the spec file instead of
  re-deriving CLI flags. The old `--onefile --windowed --collect-all
  customtkinter` invocation IGNORED the spec and silently dropped the
  bundled data files. Also added explicit $LASTEXITCODE check.

Verified end-to-end: clean PyInstaller build produces a 32MB exe with
signup_extension (8 TOC entries), world_map.png (4), customtkinter
(365) all present.

Co-authored-by: Cursor <cursoragent@cursor.com>

proxy_chain_manager/fingerprint.py

@@ -339,21 +339,24 @@ def audit_device() -> FingerprintAudit:
         "── Recommendations ────────────────────────────────",
     ]
 
-    # Quick consistency checks
-    webrtc_ok, _ = apply_webrtc_hardening.__doc__ and True or False
-    try:
-        import winreg as _wr
-        with _wr.OpenKey(_wr.HKEY_LOCAL_MACHINE, r"SOFTWARE\Policies\Google\Chrome",
-                         0, _wr.KEY_QUERY_VALUE) as k:
-            v = int(_wr.QueryValueEx(k, "DefaultWebRtcIpHandlingPolicy")[0])
-            webrtc_ok = v == 2
-    except Exception:
-        webrtc_ok = False
+    # Quick consistency checks — WebRTC IP-handling policy (Chrome / Edge)
+    webrtc_ok = False
+    for hive_root in (_WEBRTC_CHROME, _WEBRTC_EDGE):
+        try:
+            with winreg.OpenKey(
+                winreg.HKEY_LOCAL_MACHINE, hive_root, 0, winreg.KEY_QUERY_VALUE
+            ) as k:
+                v = int(winreg.QueryValueEx(k, _WEBRTC_VALUE)[0])
+                if v == _WEBRTC_DISABLE:
+                    webrtc_ok = True
+                    break
+        except OSError:
+            continue
 
-    if not webrtc_ok:
-        lines.append("  ⚠ Chrome/Edge WebRTC policy not set — enable in Privacy tab")
+    if webrtc_ok:
+        lines.append("  ✓ Chrome/Edge WebRTC IP-handling policy is set (disable_non_proxied_udp)")
     else:
-        lines.append("  ✓ Chrome/Edge WebRTC policy is set")
+        lines.append("  ⚠ Chrome/Edge WebRTC policy not set — enable in Privacy tab")
 
     # Check IPv6
     try: