feat(security): add Win32 VirtualLock memory protection, CFA error diagnostics, and ShellBag OpSec

src/vfs.rs

@@ -469,6 +469,12 @@ impl SanctumFs {
             None
         };
 
+        // Forensischer RAM-Paging-Schutz via VirtualLock (verhindert Auslagerung in pagefile.sys)
+        crate::windows::lock_memory(dek_arc.as_ptr(), 32);
+        if let Some(ref c_dek) = carrier_dek_arc {
+            crate::windows::lock_memory(c_dek.as_ptr(), 32);
+        }
+
         Self {
             db,
             dek: dek_arc,
@@ -550,6 +556,15 @@ impl SanctumFs {
     }
 }
 
+impl Drop for SanctumFs {
+    fn drop(&mut self) {
+        crate::windows::unlock_memory(self.dek.as_ptr(), 32);
+        if let Some(ref c_dek) = self.carrier_dek {
+            crate::windows::unlock_memory(c_dek.as_ptr(), 32);
+        }
+    }
+}
+
 impl DavFileSystem for SanctumFs {
     fn open<'a>(
         &'a self,