fix: harden deployment discovery and preflight

main.cjs

@@ -41,6 +41,10 @@ let diagnostics;
 let configStore;
 let tray;
 let quitCleanupStarted = false;
+const ownsSingleInstanceLock = app.requestSingleInstanceLock();
+
+if (!ownsSingleInstanceLock) app.quit();
+else app.on("second-instance", () => showMainWindow());
 
 function broadcast(channel, payload) {
   for (const window of BrowserWindow.getAllWindows()) {
@@ -171,6 +175,7 @@ function createWindow() {
 app
   .whenReady()
   .then(async () => {
+    if (!ownsSingleInstanceLock) return;
     session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
       callback({
         responseHeaders: {