- replace path.normalize() with path.posix.normalize() in
resolveRequestedFilePath to preserve forward slashes on Windows
- add empty-string guard for degenerate pathnames
- remove win32 bypass in loadPackagedEditorWindow
path.normalize() converts / to \ on Windows, causing path.resolve
to escape to the drive root and return 403 Forbidden.