fix: audit round 3 - fail-closed leak, shared asyncio loop, GOST bundling, close-X UX, persona key lookup, +29 tests

scripts/setup_and_build.ps1

@@ -39,6 +39,10 @@ Write-Host "`n== dependencies + PyInstaller =="
 # Pinned dev dep (PyInstaller version) so builds are reproducible.
 & $py -m pip install -r "$root\dev-requirements.txt"
 
+Write-Host "`n== Stage bundled GOST binary =="
+& powershell -NoProfile -ExecutionPolicy Bypass -File "$root\scripts\prepare_bundled_gost.ps1"
+if ($LASTEXITCODE -ne 0) { throw "prepare_bundled_gost.ps1 failed (exit $LASTEXITCODE)" }
+
 Write-Host "`n== PyInstaller (using ProxyChainManager.spec) =="
 # Always build from the spec — it bundles signup_extension/, world_map.png,
 # customtkinter assets, and the right hidden imports. Do NOT override with