Risky behavior now covered

• Opening an interpreted script (.py with mode 0644) from the desktop files IPC confirms before shell.openPath, and a normal markdown file still opens without that prompt.
• Windows UNC classification rejects a sibling share (\\server\\share does not allow \\server\\share2), rejects whitespace-padded UNC paths, treats \\?\\UNC\\... and //?/UNC/... as the same share as the short form (including case and surrounding whitespace), and does not let a device-namespace root authorize device or UNC targets. Empty roots still reject extended UNC, which is the external-preview path.
• Drained menu commands are held when the only subscriber has already unsubscribed, then delivered in order to the next one. A non-array drain is ignored, and live menu events still validate and deliver.

Test files added/updated

• apps/desktop/test/ipc-files.test.ts
• apps/desktop/test/ipc-security.test.ts
• apps/desktop/test/preload-boundary.test.ts

Why these tests materially reduce regression risk

These are the fail-closed edges of the #349 desktop security fixes that the existing tests did not lock. A helper-only check of .py on Windows still passes if openPath stops consulting script extensions and only prompts for the executable bit. The previous UNC tests rejected obvious attacker paths but did not lock same-share extended UNC, a share vs share2 boundary, or a leading-space bypass of the lexical check that runs before any filesystem stat. The menu-command test only covered a drain that resolved while a replacement subscriber was already registered, so a StrictMode unsubscribe that lands before the drain could drop New Chat / Settings again without a failing test.

Validation

• bun run test -- apps/desktop/test/ipc-files.test.ts apps/desktop/test/ipc-security.test.ts (45 pass). Preload must run in its own process on non-darwin because the runner does not pass --isolate; apps/desktop/test/preload-boundary.test.ts is 7 pass alone.
• biome check on the three files is clean.
• Full bun run test completed with two pre-existing flakes that also fail without these assertions: readFileForPreview reauthorizes external files rewritten with their original mtime (ctime identity, failed 1 of 5 isolated reruns) and write tool > refuses to commit when a concurrent writer changes the target after staging (passed on rerun). test/mobile.hub-link-row.test.tsx and test/mobile.toolbar-native.test.tsx exited before reporting results because apps/mobile dependencies were not installed (expo-router missing). No production code changed.