Fix Windows CJK terminal repaint and ConPTY wrap markers

Fix native Windows CJK terminal repaint and ConPTY wrap metadata handling.\n\nNormalize filesystem realpath results before authorization so WSL UNC roots compare consistently in CI.

src/main/daemon/pty-subprocess.test.ts

@@ -176,6 +176,33 @@ describe('createPtySubprocess', () => {
     )
   })
 
+  it('uses bundled ConPTY for native Windows daemon terminals', () => {
+    const proc = mockPtyProcess()
+    spawnMock.mockReturnValue(proc)
+    const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+    Object.defineProperty(process, 'platform', { value: 'win32' })
+
+    try {
+      createPtySubprocess({
+        sessionId: 'test',
+        cols: 80,
+        rows: 24,
+        cwd: 'C:\\repo',
+        env: { COMSPEC: 'C:\\Windows\\System32\\cmd.exe' }
+      })
+    } finally {
+      if (platform) {
+        Object.defineProperty(process, 'platform', platform)
+      }
+    }
+
+    expect(spawnMock).toHaveBeenCalledWith(
+      expect.any(String),
+      expect.any(Array),
+      expect.objectContaining({ useConptyDll: true })
+    )
+  })
+
   it('suppresses the first-run Powerlevel10k wizard for daemon terminals', () => {
     const proc = mockPtyProcess()
     spawnMock.mockReturnValue(proc)

src/main/daemon/pty-subprocess.ts

@@ -483,7 +483,10 @@ function spawnDaemonPtyWithWindowsFallback(args: {
       cols: args.cols,
       rows: args.rows,
       cwd,
-      env: args.env
+      env: args.env,
+      // Why: bundled ConPTY has the modern wrap-marker behavior xterm expects;
+      // legacy system ConPTY can corrupt full-width TUI rows in scrollback.
+      ...(process.platform === 'win32' ? { useConptyDll: true } : {})
     })
 
   try {

src/main/ipc/filesystem-auth.ts

@@ -328,7 +328,9 @@ export async function resolveAuthorizedPath(
   }
 
   try {
-    const realTarget = await realpath(resolvedTarget)
+    // Why: Windows/WSL realpath can return UNC-shaped paths that still need to
+    // compare against the resolved allow-list roots used by this module.
+    const realTarget = resolve(await realpath(resolvedTarget))
     if (
       !(await isPathAllowedIncludingRegisteredWorktrees(realTarget, store, {
         canonicalSourcePath: resolvedTarget