feat(electron): inspect packaged Electron fuse state without execution (#2399)

Add bounded, read-only inspection of packaged Electron fuse state for ELF, PE, and Mach-O applications through CLI and MCP workflows.

Preserve artifact provenance and unknown values, resolve app bundles without execution, reject malformed or overlapping containers before scanning, and keep output compact for agent use.

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>

src/contracts/javascript/electronToolContracts.ts

@@ -1,6 +1,8 @@
 import type { ToolContract } from "../toolContractTypes.js";
 import { toolContractMetadata } from "../toolEffects.js";
+import { electronFuseOutputSchemas } from "../toolOutputSchemaGroups.js";
 import { evidenceResultOf } from "../toolOutputSchemaPrimitives.js";
+import { inspectElectronFusesInputSchema } from "../../domain/electron/electronFuses.js";
 import {
   electronPageInspectionSchema,
   electronTargetListSchema,
@@ -147,4 +149,19 @@ export const ELECTRON_TOOL_CONTRACTS = [
       { title: "Exercise an owned Electron application", input: activeExample },
     ],
   },
+  {
+    name: "inspect_electron_fuses",
+    ...toolContractMetadata("inspect_electron_fuses"),
+    kind: "artifact-provider",
+    description:
+      "Inspect packaged Electron fuse bytes in one local macOS app bundle, Electron Framework binary, Windows PE executable, or Linux ELF executable. Returns the artifact digest, per-slice wire version, fuse index, version-1 name, state, and raw byte, plus derived implications for Inspector flags, ELECTRON_RUN_AS_NODE, embedded ASAR integrity, and app.asar-only loading. A missing sentinel is unknown fuse state. Reads artifact bytes only and does not modify the selected file or open a runtime target.",
+    inputSchema: inspectElectronFusesInputSchema,
+    outputSchema: electronFuseOutputSchemas.inspect_electron_fuses,
+    examples: [
+      {
+        title: "Read packaged Electron fuse state",
+        input: { path: "/Applications/Example.app" },
+      },
+    ],
+  },
 ] as const satisfies readonly ToolContract[];