[AndreKalberer]

EPUB chapters previously copied archive-relative image paths into the app document, so embedded illustrations did not decode. Resolve raster images within the EPUB ZIP and render them through MIME-typed blob URLs, deduplicating repeated references.

Reject unsafe archive paths and external resource references, strip active content and resource-loading attributes, and bound archive size, entry count, inflation, and chapter image resources. Revoke temporary URLs after cancellation or failure, and transfer URL ownership only after the new chapter is inserted successfully so failed navigation preserves the previous chapter. Build chapters with a document fragment to support large node counts.

Update release metadata to 2.3.8. The lockfile changes only its two root version fields; dependencies are unchanged. LG and Samsung files contain version metadata only. Native Android and TV behavior are outside this PR.

Validation completed:

• Independent source and metadata reviews found no remaining findings.
• Full consumer checks and EPUB regressions passed: real PNG decode, previous/next navigation, duplicate resources, sanitization, bounded inflation, cancellation, URL cleanup, read/insertion failures, and a 300,000-node chapter.
• The packaged Windows 2.3.8 desktop passed the new EPUB resource tests and existing desktop tests, including native GPU/server and ASAR checks, using isolated profiles.
• Syntax checks, git diff whitespace checks, and a deep lockfile comparison passed before publishing.

This is a stacked draft based on #15 (codex/hbr005-comic-cancellation, commit 4e7f320f40a9dc863e1fa7390ab68ed93e70f62b), which depends on #10. Merge order is #10, then #15, then this PR. No merge, ready-for-review transition, or installation is part of this publish action.