Free EXE Lock 8.1.0 source handoff

Contents
  work/free-exe-lock-v8.1.0: frozen Windows WPF application and NTFS engine,
    runtime/license notices, icons, build/sign scripts and brand.ini template.
  work/exe-lock-installer: production Inno sources, visible optional RK flow,
    signed-uninstaller integration, build/sign/download-audit/artwork scripts.
  work/exe-lock-release: final signed-payload and final Setup Defender verifiers.
  NOTICE.txt and SOURCE-MANIFEST.json: third-party notices and file SHA256s.

Application build (Windows x64)
  Install the .NET SDK specified by work/free-exe-lock-v8.1.0/global.json.
  From this archive root run:
    dotnet publish work/free-exe-lock-v8.1.0/FreeExeLock.csproj -c Release -r win-x64 --self-contained true -o outputs/FreeExeLock-8.1.0/Application
  The application pins the .NET desktop/runtime release 8.0.32. Restore requires
  its normal Microsoft package sources or an existing local package cache.
  Source compilation produces unsigned binaries. To sign, use the supplied
  SIGN-FILES.ps1 with a signing certificate you control. Private keys, account
  credentials, tokens and passwords are not included. The scripts' default
  certificate thumbprint is public release identity information, not a key.

Installer build
  The Inno compiler and Microsoft SDK SignTool are external build prerequisites.
  The release used Inno Setup 6.5.4; BUILD-INSTALLER pins ISCC SHA256:
    876B87E1F4261448BB682E597F5E62201594DD4B43E6779BC91FC1687F74D840
  Supply that compiler using -InnoCompiler <absolute-path-to-ISCC.exe>.
  Sign the application EXE and DLL first; pass their actual signing identity
  with -ExpectedSignerThumbprint when it differs from the release default.
  Run VERIFY-RK-DOWNLOAD.ps1 to obtain and audit the pinned official RK file.
  This audit script only downloads/verifies; it never executes RK.
  Run BUILD-INSTALLER.ps1 -Stage Validate, then -Stage Compile with the signed
  main EXE's -ExpectedSignedMainSHA256 and the compiler parameter. Production
  compilation signs both the generated uninstaller and Setup using SignTool.
  No binary compiler, runtime payload, RK installer or historical failed build
  is distributed in this source archive.

Verification and release evidence
  All production source code is preserved. QA fixtures/projects and their
  synthetic passwords are intentionally excluded. BUILD-INSTALLER -Stage Verify
  conservatively requires a successful actual-install/uninstall QA report for
  the exact newly built Setup hash; compiling alone does not approve release.
  The original signed 8.1.0 release's installation and Defender evidence is in
  its separate Validation folder and installer-release-verification.json.
  Run FINAL-VERIFY only on the final signed Application payload. The separate
  FINAL-SETUP-VERIFY scans the actual signed Setup file by its expected SHA256.
  Neither verifier changes Defender settings/exclusions or requests a sample
  submission. Scan results apply to the recorded hashes/engine/signatures/time.

Source fidelity and data handling
  Frozen .cs/.xaml and Core files are byte-identical to their production sources.
  README.txt carries the published clarification that the optional Demo is only
  in the ZIP's top-level Demo folder, outside the manager installation directory.
  Assets/Licenses and the brand.ini template are included. No user vaults,
  recovery kits, profile catalogs, cached builds, bin/obj, server configuration,
  server credentials, signing private keys or QA synthetic passwords are bundled.
  The source manifest excludes itself to avoid a circular checksum definition.

Protection and uninstall
  This manager controls NTFS execution/read permissions for the current account.
  It does not rewrite or wrap the selected EXE. Restore the original permissions
  through the manager before launching the EXE. Keep your original password and
  encrypted vault/recovery backup. Uninstall checks all registered profiles,
  preserves user data and brand.ini, and fails closed when safety is uncertain.
  RK is a separately managed, visible optional invitation; declining it leaves
  the manager usable. It is not executed during unattended installation tests.