Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/desktop-electron/src/main/renderer-protocol.test.ts`:
- Around line 20-30: Add a test in renderer-protocol.test.ts that passes
malformed/invalid URL inputs to resolveRendererFile and asserts it returns null
(not throwing); specifically call resolveRendererFile(root, "not-a-url") and
maybe other bad inputs like an empty string or a truncated scheme (e.g.,
"pawwork-renderer:/bad") and assert toBeNull for each, ensuring
resolveRendererFile handles URL parsing failures gracefully.

In `@packages/desktop-electron/src/main/renderer-protocol.ts`:
- Around line 11-27: In resolveRendererFile, after decoding the pathname with
decodeURIComponent(url.pathname) add an explicit null-byte check (e.g., if
(path.includes('\0')) return null) to reject inputs containing %00 before any
fs/path operations; update or add unit tests that call resolveRendererFile with
null-byte attempts (for example "pawwork-renderer://renderer/index.html%00.js")
to assert it returns null.

In `@packages/desktop-electron/src/main/store.test.ts`:
- Around line 27-34: The failing assertion is caused by shared cached
default-store state; update the test to use a test-unique store name when
calling getStore so constructorCalls is isolated per test (e.g., generate a
unique string and pass it into getStore instead of relying on the default), then
assert constructorCalls transitions 0 -> 1 accordingly; locate and modify the
test invoking getStore and the constructorCalls assertions in store.test.ts to
supply a unique name for each run.