fix: portable 绿色单机版 SSH 连接 + 主机数据 + 打包体积

SSH 连接修复：
- main.cjs 顶部在所有 ssh2 require 之前安装 boringSslDhCompat 补丁
- 5 条 SSH 连接路径统一 legacyAlgorithms 默认值为 true

portable 版主机数据修复：
- main.cjs portable 模式设置 NETCATTY_PORTABLE=1
- preload.cjs 暴露 window.netcatty.isPortable
- useVaultState portable 模式跳过 safeStorage DPAPI 加密的 hosts_v1
- inspection saveVaultHosts handler 补 legacyAlgorithms/tags/os 字段映射

打包体积修复：
- 恢复 electron-builder.config.cjs 原始 40+ 条排除规则
- package.json 加 pend 运行时依赖

electron-builder.config.cjs

@@ -1,10 +1,6 @@
-const path = require('node:path');
+const path = require('node:path');
 const { moshExtraResources } = require('./scripts/mosh-extra-resources.cjs');
 const { etExtraResources } = require('./scripts/et-extra-resources.cjs');
-// 说明：electron-builder 依赖收集器在 monorepo/workspace 项目里会漏掉
-// workspace 子包引用但根 package.json 没声明的运行时依赖（hoist 上来的），
-// 且追踪传递依赖时容易漏包。这里直接把整个 node_modules 目录纳入 files，
-// 确保运行时 require 什么都能找到。用排除列表去掉前端/构建工具/文档/测试代码。
 
 /**
  * @type {import('electron-builder').Configuration}
@@ -58,19 +54,117 @@ module.exports = {
         output: 'release'
     },
     files: [
-    // electron-builder 收集器只读根 package.json，但 workspace 子包的运行时依赖
-    // 会 hoist 到根 node_modules 却没在根 package.json 里声明。
-    // 收集器会漏掉这些包，所以把漏的补进根 package.json 后它就能追踪完整传递依赖树。
-    "dist/**/*",
-    "electron/**/*",
-    "!electron/bridges/windowsHelloHelper/build/**/*",
-    "!electron/plugins/fixtures/**/*",
-    "infrastructure/config/terminalFlowConstants.cjs",
-    "infrastructure/config/terminalFlowConstants.json",
-    "domain/terminalPromptSecurity.shared.cjs",
-    "lib/**/*.cjs",
-    "lib/**/*.json",
-    "skills/**/*"
+        'dist/**/*',
+        'electron/**/*',
+        // The Windows Hello helper is shipped once through win.extraResources.
+        // Exclude local per-arch build output from app.asar on every platform.
+        '!electron/bridges/windowsHelloHelper/build/**/*',
+        // Runtime smoke fixtures are built test packages, not host resources.
+        // Keep them out of production ASARs so no example plugin can be
+        // mistaken for an installed or host-trusted package.
+        '!electron/plugins/fixtures/**/*',
+        // Main-process terminal flow control reads shared thresholds from here
+        // (terminalFlowAck.cjs). Must ship beside electron/ in app.asar.
+        'infrastructure/config/terminalFlowConstants.cjs',
+        'infrastructure/config/terminalFlowConstants.json',
+        // Renderer and Mosh's main-process bootstrap share the same
+        // fail-closed prompt classifier at runtime.
+        'domain/terminalPromptSecurity.shared.cjs',
+        'lib/**/*.cjs',
+        'lib/**/*.json',
+        'skills/**/*',
+        '!public/**/*',
+        '!**/*.map',
+        '!**/*.d.ts',
+        '!**/*.d.mts',
+        '!**/*.d.cts',
+        '!**/*.ts',
+        '!**/*.tsx',
+        '!**/*.test.*',
+        '!**/*.spec.*',
+        '!**/__tests__/**/*',
+        '!**/test/**/*',
+        '!**/tests/**/*',
+        '!**/example/**/*',
+        '!**/examples/**/*',
+        '!node_modules/**/docs/**/*',
+        '!node_modules/**/doc/**/*',
+        '!node_modules/**/benchmark/**/*',
+        '!node_modules/**/benchmarks/**/*',
+        // Renderer-only packages are compiled into dist by Vite. Keep them
+        // installed for npm run dev/build, but do not ship the duplicate source
+        // packages in release artifacts.
+        '!node_modules/@fontsource/**/*',
+        '!node_modules/@monaco-editor/**/*',
+        '!node_modules/@radix-ui/**/*',
+        '!node_modules/@xterm/**/*',
+        '!node_modules/lucide-react/**/*',
+        '!node_modules/monaco-editor/**/*',
+        '!node_modules/react/**/*',
+        '!node_modules/react-dom/**/*',
+        '!node_modules/ai/**/*',
+        '!node_modules/@ai-sdk/**/*',
+        '!node_modules/@mdxeditor/**/*',
+        '!node_modules/streamdown/**/*',
+        '!node_modules/@streamdown/**/*',
+        '!node_modules/@tanstack/react-virtual/**/*',
+        '!node_modules/pinyin-pro/**/*',
+        '!node_modules/re2js/**/*',
+        '!node_modules/@eslint-community/regexpp/**/*',
+        '!node_modules/clsx/**/*',
+        '!node_modules/tailwind-merge/**/*',
+        '!node_modules/use-stick-to-bottom/**/*',
+        '!node_modules/lexical/**/*',
+        '!node_modules/@lexical/**/*',
+        '!node_modules/@codemirror/**/*',
+        '!node_modules/katex/**/*',
+        '!node_modules/shiki/**/*',
+        '!node_modules/@shiki/**/*',
+        // Heavy cloud completion specs are intentionally not bundled. The main
+        // process filters the same prefixes so dev and packaged builds behave
+        // consistently.
+        '!node_modules/@withfig/autocomplete/build/aws.js',
+        '!node_modules/@withfig/autocomplete/build/aws/**/*',
+        '!node_modules/@withfig/autocomplete/build/gcloud.js',
+        '!node_modules/@withfig/autocomplete/build/gcloud/**/*',
+        '!node_modules/@withfig/autocomplete/build/az/**/*',
+        // Fig specs are already compiled JavaScript; TypeScript is only pulled
+        // in by Fig helper packages as build tooling and is not needed at app
+        // runtime.
+        '!node_modules/typescript/**/*',
+        // ── Exclude per-platform native agent binaries (~100s of MB each). ──
+        // Netcatty is "bring your own CLI": each SDK is pointed at the user's
+        // system-installed CLI via an absolute path override (claude
+        // pathToClaudeCodeExecutable / codex codexPathOverride / copilot cliPath).
+        // Only the SDKs' JS is bundled; the heavy per-arch binaries are dropped.
+        // NOTE: claude-agent-sdk vendors the `claude` binary as a NESTED package
+        // (claude-agent-sdk/node_modules/@anthropic-ai/claude-agent-sdk-<arch>),
+        // so this exclusion must match at any depth (**/), not just top-level.
+        // The codex/copilot exclusions target only the per-arch binary packages
+        // (codex-<arch> / copilot-<arch>) — NOT @openai/codex-sdk / copilot-sdk,
+        // whose JS we DO bundle. @github/copilot is the full ~288MB CLI (with
+        // per-platform prebuilds); netcatty uses the user's copilot via cliPath,
+        // so it is excluded entirely.
+        '!**/@anthropic-ai/claude-agent-sdk-*/**/*',
+        '!node_modules/@anthropic-ai/claude-code-*/**/*',
+        '!node_modules/@openai/codex-{darwin,linux,linuxmusl,win32}-*/**/*',
+        '!node_modules/@github/copilot-{darwin,linux,linuxmusl,win32}-*/**/*',
+        '!node_modules/@github/copilot/**/*',
+        '!node_modules/opencode-{darwin,linux,linuxmusl,windows}-*/**/*',
+        '!node_modules/opencode-ai/**/*',
+        // CodeBuddy follows the same first-party integration model as the
+        // other coding agents: Netcatty discovers and passes the user's
+        // installed CLI path to the SDK. Keep the small SDK wrapper, but do not
+        // bundle the full CodeBuddy CLI payload (rg vendors + web UI).
+        '!node_modules/@tencent-ai/agent-sdk/cli/**/*',
+        // Netcatty loads Cursor SDK through ESM dynamic import, so the duplicate
+        // CommonJS build and type metadata are not needed at runtime.
+        '!node_modules/@cursor/sdk/dist/cjs/**/*',
+        '!node_modules/@cursor/sdk/dist/**/*.d.ts',
+        '!node_modules/@cursor/sdk/dist/**/*.d.ts.map',
+        // sqlite3 rebuilds a native module for Electron; its upstream source
+        // tarball is build-time payload only.
+        '!node_modules/sqlite3/deps/**/*'
     ],
     asarUnpack: [
         'node_modules/node-pty/**/*',