[low] Profile and Electron smalls (grouped) #501

Severity: low

• Body: built-in guards are case-sensitive on APFS; empty name writes root config; orphan dirs after failed create/import; export masks secrets then import writes placeholders back; no logout or session revocation; Electron has no will-navigate guard, no error listener on spawn('bash'), starts a second server on a duplicate instance, and hard-codes the version. (The legacy {patch} bypass and the plugin-sync 404 recovery are already tracked.)
• Evidence: profiles-browser.ts:231-234,654-661,789; electron/main.cjs:28-29,164,181-186,316; auth-middleware.ts:199.

Already tracked: #422, #407

Source: docs/overnight-2026-10-26/round2/issues-draft-2.md § HS11
Filed from the 2026-10-26 overnight audit (read-only findings, not yet triaged).