Implement controlled app launch (T-401)

schemas/installed-app.schema.json

@@ -30,6 +30,24 @@
     "channel": {
       "const": "stable"
     },
+    "entrypoint": {
+      "type": "string",
+      "minLength": 1,
+      "$comment": "Optional for pre-T-401 v1 records; new installations write a runtime-validated safe relative payload path.",
+      "pattern": "^(?!/)(?! )(?!.*(/ ))(?!.*\\\\)(?!.*[:<>\"|?*])(?!\\.\\.?(/|$))(?!.*(/\\.\\.?)(/|$))(?!.*//)(?!.*[ .](/|$)).+$"
+    },
+    "working_directory": {
+      "type": "string",
+      "minLength": 1,
+      "$comment": "Optional for pre-T-401 v1 records; new installations write . or a runtime-validated safe relative payload directory.",
+      "pattern": "^(\\.|(?!/)(?! )(?!.*(/ ))(?!.*\\\\)(?!.*[:<>\"|?*])(?!\\.\\.?(/|$))(?!.*(/\\.\\.?)(/|$))(?!.*//)(?!.*[ .](/|$)).+)$"
+    },
+    "min_os": {
+      "enum": ["windows-7-sp1", "windows-10", "windows-11"]
+    },
+    "requires_admin": {
+      "type": "boolean"
+    },
     "files": {
       "type": "array",
       "items": {