Remove unsafe-eval and wasm-unsafe-eval from the Electron renderer CSP #2381

Summary

The Electron renderer's Content Security Policy allows unsafe-eval and wasm-unsafe-eval.

Why it matters

These directives weaken protection against injected scripts. The app renders user notes and content from agents and skills, so a stricter CSP reduces the injection risk. The renderer already has good controls (sandbox, context isolation, IPC sender validation); this closes a remaining gap.

Proposal

• Remove unsafe-eval from the renderer CSP. Replace code paths that need eval() / new Function() (e.g. some template or charting libraries) with safer alternatives.
• If WebAssembly is needed, keep wasm-unsafe-eval only for the specific window that needs it, and document why.
• Add a test that fails if the CSP contains unsafe-eval.

Acceptance criteria

• The default renderer CSP has no unsafe-eval.
• wasm-unsafe-eval is removed or limited and documented.