refactor(desktop-electron): enable contextIsolation and sandbox

[Brendonovich]

Summary

Refactors the Electron desktop app to use proper security practices by enabling contextIsolation and sandbox on BrowserWindows, and removes the injectGlobals anti-pattern.

Changes

• Security: Enables contextIsolation: true, nodeIntegration: false, and sandbox: true on all BrowserWindows
• IPC: Replaces injectGlobals (which used executeJavaScript to pollute window) with proper IPC handlers:
  • getWindowConfig — returns { updaterEnabled }
  • consumeInitialDeepLinks — returns pending deep links at startup
• Preload: Fixes preload output format to CJS (.js instead of .mjs) to work with sandboxed renderer
• Renderer: Updates all consumers to fetch config/deep links via window.api instead of window.__OPENCODE__

Motivation

The previous approach disabled Electron's security model (sandbox: false, contextIsolation: false) and injected globals via executeJavaScript. This refactor aligns with Electron security best practices while preserving all existing functionality.