chore(deps): upgrade electron 31 -> 43 (fixes 17 shipped-app security advisories)

Electron ships INSIDE the packaged app, so the 17 Chromium/Electron
advisories on the v31 line (ASAR integrity bypass, several use-after-frees,
HTTP header injection in custom protocol handlers, etc.) were only truly
resolved by upgrading — and Electron only backports security fixes to the
latest three majors (41/42/43), so v31 was EOL and receiving none. 43 is
the newest supported line (longest runway to the next forced bump).

npm audit now reports 0 vulnerabilities (was 1 'high' meta-advisory
bundling all 17). node-pty stays on its N-API prebuilt (ABI-stable, no
recompile). electron-builder 26.8.1 packages 43 unchanged.

Verified the full chain locally before shipping:
- tsc + renderer bundle build clean; 416 unit tests pass
- runtime (dev, electron 43): qa audit green (boot, IPC, window controls,
  a11y across all views); node-pty PTY smoke 4/4 — spawns, streams 280
  bytes back, input reaches the shell, no native crash
- packaging: electron-builder --win --dir builds a 43.1.0 win-unpacked with
  node-pty's conpty.node asar-unpacked; driving the PACKAGED DevDeck.exe
  itself 5/5 — boots, isPackaged, preload+IPC work, renderer mounts
The 3-OS release CI packages macOS/Linux too as the final cross-platform gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ao9Qrd3UvirJiWYWsALyjn

Author: writingdeveloper