v0.1.36b: 真根因修复——CSP unsafe-eval 拦截 Function() 字符串求值（推进崩溃+定制白屏同根）

【根因】Electron 打包 renderer CSP 禁 unsafe-eval;buildings.bonusOf / exprToTable / modManager.booleanExprTable
三处用 Function()+正则白名单字符串求值——任何调用点抛 EvalError:
·推进崩溃=每月月率 bonusOf('juling','expBonus') 等(MarketPanel craft 表头同源)
·定制白屏=craft 页渲染行内 bonusOf('danfang','craftChance') → React 崩 → 只剩背景
【修复】全新 arith.ts 纯解析器(令牌化+递归下降:数字/L/四则/括号/幂/负号——白名单天然,字母函数名一律 NaN),
三处替换零 Function/eval;非法输入 NaN 不抛(调用方 Number.isFinite 跳过)
【测试】arith 4 例(四则/幂右结合/负号/除零/非法输入防注入)+全量 7011 绿
【版本】0.1.36(同版本内提交——不另立迭代)

src/renderer/game/engine/runtime/modManager.ts

@@ -8,6 +8,7 @@ import { EventDef } from '../../data/events'
 import { findEvent } from './Systems/events'
 import { World } from './World'
 import { WorldGenPools } from '../sim/worldgen'
+import { arith } from '../../data/arith'
 import { pack as dataPack } from '../../data/registry'
 import { removeCalamityByName, overrideWorldNum, resetWorldNum } from '../sim/worldsim-data'
 import { removePillRecipe, removeForgeRecipe } from '../../data/items'
@@ -54,12 +55,8 @@ function booleanExprTable(expr: string | Record<string, string>): (level: number
   return (L: number) => {
     const out: Record<string, number> = {}
     for (const [k, v] of entries) {
-      const sanitized = String(v).replace(/L/g, String(L))
-      if (!/^[0-9.\s+\-*/()^]+$/.test(sanitized)) continue
-      try {
-        const val = Function(`"use strict";return (${sanitized.replace(/\^/g, '**')})`)() as number
-        if (Number.isFinite(val)) out[k] = Math.round(val)
-      } catch { /* 非法表达式跳过 */ }
+      const val = arith(String(v), L)
+      if (Number.isFinite(val) && val >= 0) out[k] = Math.round(val)
     }
     return out
   }