Electron 43.8.1 contains the fix for GHSA-jr5w-w6x2-84p9, the
mitigation for compromised eMudhra intermediate certificates. It also
makes link-opened windows use the opener's session and webPreferences
(electron/electron#55049), and setCertificateVerifyProc is no longer
skipped for a request issued concurrently with the first request to a
host (electron/electron#55047). 43.8.3, the newest 43.x release, adds
electron/electron#55147: 64 upstream cherry-picks from ANGLE,
Chromium, PDFium, Skia and V8, including use-after-free fixes and
"[net] Validate server certificate before generating auth token". It
embeds the same Node.js 24.22.0, so the modules ABI stays 148.

Update every pin together so the release-input gates agree, as #191
did:
- the package.json devDependency and allowScripts entry, and
  package-lock.json (npm install --save-exact [email protected]);
- electron.version in release/linux-inputs.json,
  release/macos-inputs.json and release/windows-inputs.json, and
  PINNED_ELECTRON_VERSION in scripts/windows-release-inputs.mjs;
- the linux-inputs.json SHA-256 pinned by the AppImage (x64, arm64)
  and DEB contracts, and their tests;
- the tests that compare with the real pins, and the release docs.
Test placeholders that never compare with the real pin, and
historical records, keep 43.8.0.

How Electron's downloads are checked: the release build does not use
the npm package's checksums.json. The three thin-app builders call
packager() without a download or electronZipDir option, so
@electron/get checks each zip only against the release's live
SHASUMS256.txt. At bump time all 75 checksums.json entries matched
the official v43.8.3 SHASUMS256.txt, and the five packaged zips also
match GitHub's asset digests. Pinning the build to checksums.json is
tracked in #363.

The #135 fix now comes from Node.js itself: Electron dropped its
electron/electron#53393 backport when 43.8.0 moved to Node.js 24.22.0
(electron/electron#55003), because 24.22.0 carries the cleanup-hook
registry fix. 43.7.11 is the last release with the patches.
docs/macos-release.md and the electron-sqlite-check abort message now
say so. nodejs/node#65446 is still open, and the portable runtime
keeps its 24.18.1 hold (#362).

Every packaging job's allocation-driven SQLite check passed under
Electron 43.8.3 with Node v24.22.0 (ABI 148): the Linux folders,
AppImage and DEB on x64 and arm64, both macOS thin apps (native Intel
included), and the Windows native folder and MSI folders. The
Electron executable still needs glibc 2.25 on Linux x64 and arm64.

Supersedes #355.

Co-authored-by: Copilot <[email protected]>
Copilot-Session: 9e7ec7a7-8690-49e5-9d55-492fedc3027a