fix: ensure clean installs and tests on Windows and Linux

[AKollu72]

What breaks

Cloning the repo on Windows or Linux and running npm ci fails right away, during postinstall:
`Error: Cannot find module 'extract-zip'
Require stack:

…\errand\scripts\ensure-electron.mjs`

The install script uses two packages that aren't declared in package.json:

• extract-zip — used to arrive as part of Electron itself, but Electron 44 stopped shipping it internally, so on a fresh install it's simply not there anymore.
• @electron/get — still works today, but only because npm happens to hoist it out of Electron's own dependencies. One resolver change and it breaks the same way.

There's also one test that fails on Windows: appBranding.test.ts expects forward-slash paths, but storageDirectory builds paths with path.join, which produces backslashes on Windows.

Why you've never seen it

On macOS the script extracts Electron with ditto, so the extract-zip line never runs and macOS paths use forward slashes anyway. Since CI runs on macos-15 only, both problems are invisible there. They only show up for someone cloning on Windows or Linux which is how I found them.

The fix

• Declare both packages in devDependencies (@electron/get@^5.1.0, which dedupes with Electron's own copy, and extract-zip@^2.0.1). Lockfile updated.
• Build the two path expectations in appBranding.test.ts with join(...) / resolve(...) instead of hardcoded slashes, same pattern as the test's own third assertion already uses. What the test checks hasn't changed.

Verified on Windows 11 (Node 24, npm 11)

• Deleted node_modules, ran npm ci from scratch installs cleanly, Electron extracts.
• npm run typecheck, npm run lint, npm test (179/179), and npm run build all pass.
• The dev app runs fine on Windows:

One small thing I noticed

npm run test:ui points at a vitest project (--project renderer) that isn't defined in vitest.config.ts, so it fails on every platform. Hence I'm happy to fix in a follow-up if you'd like.

---

Thanks for open-sourcing Errand, the codebase was easy to find my way around, and it runs nicely on Windows in dev mode.

[shiqimei]

Thanks for the contribution! We're holding off on merging this PR because the newly added extract-zip@2.0.1 is affected by known symlink path traversal and arbitrary file write vulnerabilities:

• GHSA-jmr9-qjv8-65gv
• GHSA-7pqw-9j4j-h8q3

Both advisories cover version 2.0.1 and currently list no patched version. We'll wait for an upstream fix, then revisit merging this PR with the fixed dependency.

[AKollu72]

Completely fair call. Thanks for auditing the dep chain, those advisories are real. One detail worth noting for context. The vulnerable extract-zip path already runs today via Electron's own internals on non-macOS installs, so the exposure predates this PR, declaring the dependency just makes it visible.

I'll watch for an upstream patch and update here when one lands. Meanwhile, if you'd prefer, I can rework the script to avoid extract-zip entirely e.g., using Node's built-in unzip capabilities or @electron/get's own extraction, so that non-macOS contributors get unblocked without waiting on the advisory. Happy either way.