fix: audit round 3 - fail-closed leak, shared asyncio loop, GOST bundling, close-X UX, persona key lookup, +29 tests

ProxyChainManager.spec

@@ -28,6 +28,12 @@ datas += tmp_ret[0]; binaries += tmp_ret[1]; hiddenimports += tmp_ret[2]
 _BUNDLE_DATA = [
     ('proxy_chain_manager/signup_extension', 'proxy_chain_manager/signup_extension'),
     ('proxy_chain_manager/world_map.png',    'proxy_chain_manager'),
+    # B-06: Bundle gost.exe (and its SHA256 sidecar) so first run works
+    # offline.  scripts/prepare_bundled_gost.ps1 stages these files before
+    # PyInstaller runs.  Missing files are silently skipped so source
+    # checkouts that haven't staged the binary still build.
+    ('proxy_chain_manager/_bundled/gost.exe',       'proxy_chain_manager/_bundled'),
+    ('proxy_chain_manager/_bundled/gost.exe.sha256','proxy_chain_manager/_bundled'),
 ]
 for src, dest in _BUNDLE_DATA:
     p = _ROOT / src