fix desktop navigation boundary

[snowopsdev]

Summary

• Add a main-window navigation policy that keeps the Electron app document on the trusted app URL/origin.
• Block untrusted top-level will-navigate and main-frame will-redirect attempts, while preserving the existing allowlisted external-open behavior.
• Route Markdown links through a safe renderer helper so workspace Markdown cannot rely on default top-level navigation.
• Add focused tests for trusted navigation classification and Markdown link classification.

Closes #339

Why

Workspace Markdown is untrusted content rendered inside the desktop app chrome. The app already denied window.open attempts, but top-level navigation and redirects also need to be guarded so a clicked Markdown link cannot replace the trusted app document in the main BrowserWindow.

Test Plan

• pnpm --filter @open-codesign/desktop exec vitest run src/main/navigation-policy.test.ts src/renderer/src/lib/markdown-links.test.ts src/main/open-external.test.ts
• pnpm --filter @open-codesign/desktop typecheck
• pnpm --filter @open-codesign/desktop test
• pnpm typecheck
• pnpm lint
• pnpm test