Harden launcher: enable CFG/CET, restrict DLL search path, verify ConEmu before launch

The work is in launcher/src/CmderLauncher.cpp and launcher/CmderLauncher.vcxproj. Start by building the launcher to understand the project structure. Review the specific lines mentioned for the undefined behavior with swprintf_s and the ConEmu launch path. The verification step uses dumpbin to check security flags after building.

Summary

The launcher (launcher/src/CmderLauncher.cpp) is built with the MSVC defaults only, and it starts ConEmu without checking the file first. This issue collects some low-cost hardening. It's a follow-up to #3116.

Proposed changes

1. Turn on Control Flow Guard and CET shadow stacks. launcher/CmderLauncher.vcxproj sets neither, so both are off. ASLR and DEP are already on by default. Add to the Release configurations:

   • <ControlFlowGuard>Guard</ControlFlowGuard> (compile)
   • <CETCompat>true</CETCompat> (link)

2. Restrict the DLL search path. Call SetDefaultDllDirectories(LOAD_LIBRARY_SEARCH_SYSTEM32) at the start of wWinMain, or link with /DEPENDENTLOADFLAG:0x800. That way a DLL planted next to Cmder.exe isn't picked up. This matters most for installs in admin-only locations (e.g. global Scoop or Chocolatey installs).

3. Check ConEmu before launching it. StartCmder passes vendor\conemu-maximus5\ConEmu64.exe (or ConEmu.exe) to CreateProcess without checking it (CmderLauncher.cpp#L422-L426, #L481). Portable installs are user-writable, so a replaced binary would run under Cmder's name. Options:

   • WinVerifyTrust against the expected publisher, if upstream ConEmu binaries are signed; or
   • compare against a SHA-256 recorded at build time (see #3116).

4. Stop reading and writing the same buffer in swprintf_s. The ConEmu command line is built with swprintf_s(args, L"%s ...", args, ...) (#L429-L461). Because the source and destination are the same buffer, the result is undefined behaviour. It works with MSVC today, but building the string with std::wstring would be simpler and safe.

Verifying

On a Windows runner, after building:

dumpbin /headers Cmder.exe | Select-String "Dynamic base|NX compatible|High Entropy|Guard|CET"

This could be added as a CI step so the flags don't regress.