feat(renderer): platform-gated dual renderer backend with isolated QtWebEngine profiles

Windows prefers WebView2, Linux uses QtWebEngine only; pythonnet deps are win32-marked. Each QtWebEngine instance gets its own profile under data/webengine, and Chromium flags are sanitized before QApplication (--no-sandbox accepted only for explicit root/container use).

main.py

@@ -67,6 +67,14 @@ from PyQt6.QtCore import Qt
 # 确保 Python 能找到项目根目录下的模块
 sys.path.append(os.path.dirname(os.path.abspath(__file__)))
 
+# P1-03：Chromium sandbox 契约（在导入 PyQt6/QtWebEngine 前处理；renderer_backend 仅 stdlib）
+# - 默认保留 sandbox；--no-sandbox 仅在显式配置 + root/容器场景下接受（高可见警告）
+# - 普通桌面运行中的 --no-sandbox 被剥离并告警
+from core import renderer_backend as _renderer_backend
+os.environ["QTWEBENGINE_CHROMIUM_FLAGS"] = _renderer_backend.sanitize_chromium_flags(
+    os.environ["QTWEBENGINE_CHROMIUM_FLAGS"])
+print(f"[渲染] 最终 QTWEBENGINE_CHROMIUM_FLAGS = {os.environ['QTWEBENGINE_CHROMIUM_FLAGS']!r}", flush=True)
+
 # 导入主窗口类
 from ui.views.main_window import MainWindow