Harden Windows package paths (T-605)

schemas/manifest.schema.json

@@ -150,7 +150,8 @@
         "entry_exe": {
           "type": "string",
           "minLength": 1,
-          "pattern": "^(?!/)(?!.*\\\\)(?!.*:)(?!\\.\\.?(/|$)).+$"
+          "$comment": "Runtime validation additionally rejects invalid UTF-8/control characters and Windows reserved device names; this pattern is only a basic shape constraint.",
+          "pattern": "^(?!/)(?! )(?!.*(/ ))(?!.*\\\\)(?!.*[:<>\"|?*])(?!\\.\\.?(/|$))(?!.*(/\\.\\.?)(/|$))(?!.*//)(?!.*[ .](/|$)).+$"
         },
         "requires_admin": {
           "type": "boolean"