Free EXE Lock 8.1.0 installer build

Public setup: FreeFileLock.exe. Installed manager: FreeExeLock.exe.
Per-user AppId: {D5567CA2-7B0E-4853-863E-DEB5527D12A8}
Default directory: %LOCALAPPDATA%\Programs\Free EXE Lock
Brand identity/site remain editable in brand.ini.

Current stage: final application frozen and signed; Setup and generated
uninstaller signed. Real isolated install/upgrade/safe-uninstall QA and final
official Defender scans passed. See outputs/FreeExeLock-8.1.0/Validation and
installer-release-verification.json for exact final hashes and evidence.

1. VERIFY-RK-DOWNLOAD.ps1 downloads the official RK installer to Validation and
   verifies fixed SHA256, official TMRG Authenticode and timestamp. It never runs
   the file and refuses to overwrite existing audit evidence.
2. BUILD-PREVIEW.ps1 creates an explicitly marked UI-only preview in work/Preview.
   The unchanged RK flow exits before download in PreviewOnly mode and prevents
   main application installation. Do not distribute it as the product installer.
3. Wait for root to freeze final application including its safe-uninstall CLI.
   Sign FreeExeLock.exe and FreeExeLock.dll with SIGN-FILES.ps1. Do not recompile
   or alter application/README/brand after freezing the installer payload.
4. BUILD-INSTALLER.ps1 -Stage Validate -PayloadDirectory <signed directory>
5. BUILD-INSTALLER.ps1 -Stage Compile -PayloadDirectory <signed directory>
   -ExpectedSignedMainSHA256 <complete hash>
   Default final payload is outputs/FreeExeLock-8.1.0/Application.
6. The production Inno build invokes SIGN-FILES.ps1 automatically for its
   generated uninstaller and final Setup (SignedUninstaller=yes). The existing
   signed application payload is preserved. SignToolRetryCount=0 prevents
   repeated signing attempts. Inno removes its uninst.e32.tmp after compilation.
7. Perform TEST-SILENT-INSTALL.ps1 -ExpectedSetupSHA256 <complete hash>, with
   silent RK skipped. Do not
   test against a user's existing installation/profile/catalog. Verify branding
   survives upgrade and ordinary uninstall, user vault/catalogs are retained,
   and a protected/busy/unreadable profile prevents actual manager removal.
8. BUILD-INSTALLER.ps1 -Stage Verify rechecks all frozen payload hashes plus
   main EXE, main DLL and Setup signatures/timestamps and the actual installed
   signed uninstaller evidence from successful isolated QA.
9. Run final official Defender scans on signed application, demo and setup;
   preserve stdout/exit, normal real-time protection and exact SHA manifests.

RK integration is an unchanged visible official invitation/downloader. Product
attribution SCI_FreeEXELock_NEW follows the existing naming rule and was selected
by root; vendor-side accounting registration was not independently verified.
Installer code performs no RK silent install, automated consent, security
exclusion, service change, driver, injection or target EXE permission change.
The installed manager changes permissions only for explicitly selected targets.

Uninstall contract:
FreeExeLock.exe --uninstall-check [--non-interactive]
0: all registered profiles safe; 10: protected/cancel; 11: manager/profile busy;
12: configuration/read/check error. Only 0 permits uninstall. Formal uninstaller
does not pass --data-dir or another profile override. Silent mode never prompts
for a password and blocks if any registered profile has a vault.

The uninstaller first waits for all normal Manager markers to close, creates a
Local\FreeExeLock.Uninstall marker, verifies it exists and rechecks Manager, then
runs the application safety check. Inno's marker handle is retained by the
uninstaller process until process exit and is not inherited by the checker.
Normal App creates Local\FreeExeLock.Manager before checking the uninstall
marker, so a new ordinary manager cannot start between the check and removal.
No manager is forcefully terminated. These Local markers have session scope.

User vaults and profile catalog are outside the application tree, excluded from
the build and never deleted by installer code. Existing brand.ini is installed
only if absent and marked uninsneveruninstall. RK status is not research consent.
