fix: audit round 2 - DPAPI secrets, pinned hop probe, gost exe hash, admin guard, PID-scoped browser tracking, emergency disengage button, build sidecar

scripts/setup_and_build.ps1

@@ -36,7 +36,8 @@ Write-Host "`n== pip (upgrade) =="
 
 Write-Host "`n== dependencies + PyInstaller =="
 & $py -m pip install -r "$root\requirements.txt"
-& $py -m pip install pyinstaller
+# Pinned dev dep (PyInstaller version) so builds are reproducible.
+& $py -m pip install -r "$root\dev-requirements.txt"
 
 Write-Host "`n== PyInstaller (using ProxyChainManager.spec) =="
 # Always build from the spec — it bundles signup_extension/, world_map.png,
@@ -52,10 +53,17 @@ if (-not (Test-Path $distExe)) {
     throw "Build failed: missing $distExe"
 }
 
+# SHA256 sidecar so the release artifact is self-verifiable.
+$distHashFile = "$distExe.sha256"
+$distHash = (Get-FileHash -Algorithm SHA256 -LiteralPath $distExe).Hash.ToLower()
+"$distHash *ProxyChainManager.exe" | Out-File -FilePath $distHashFile -Encoding ascii -Force
+Write-Host "SHA256: $distHash → $distHashFile"
+
 $desk = [Environment]::GetFolderPath("Desktop")
 $deskExe = Join-Path $desk "ProxyChainManager.exe"
 Copy-Item -LiteralPath $distExe -Destination $deskExe -Force
-Write-Host "Copied: $deskExe"
+Copy-Item -LiteralPath $distHashFile -Destination "$deskExe.sha256" -Force
+Write-Host "Copied: $deskExe (+ .sha256)"
 
 Write-Host "`n== Desktop shortcut =="
 & powershell -NoProfile -ExecutionPolicy Bypass -File "$root\scripts\create_desktop_shortcut.ps1"