chore: bump version to 0.3.8

Code audit fixes:
- CRITICAL: reorder Markdown pipeline (fixImages before sanitize)
- CRITICAL: fix path prefix separator check
- BLOCKING: remove duplicate useEffect in Editor
- BLOCKING: skip onChange when content unchanged
- BLOCKING: optimize Sidebar re-render with useMemo
- HIGH: cleanup FileWatcher polling intervals
- HIGH: improve validatePath segment check
- HIGH: fix isExternalUpdate race with counter
- HIGH: add will-navigate / setWindowOpenHandler
- HIGH: explicit strip in sanitize schema
- MEDIUM: random temp file suffix instead of Date.now()
- MEDIUM/LOW: add IndexedDB error boundaries
- LOW: support UTF-16 BOM detection

src/main/window-manager.ts

@@ -21,6 +21,12 @@ export function createWindow(): BrowserWindow {
 
   mainWindow.setMenu(null)
 
+  // H-04: 阻止窗口导航和弹出窗口，防止渲染进程绕过 CSP
+  mainWindow.webContents.on('will-navigate', (event) => {
+    event.preventDefault()
+  })
+  mainWindow.webContents.setWindowOpenHandler(() => ({ action: 'deny' }))
+
   mainWindow.once('ready-to-show', () => {
     mainWindow.show()
   })