fix(ui): harden table drag and keychain startup

src/utils/downloadTableColumns.test.ts

@@ -56,7 +56,7 @@ describe('download table column preferences', () => {
 
   it('keeps user widths fixed while reserving a shared trailing spacer track', () => {
     expect(buildColumnGridTemplate([...DEFAULT_COLUMN_ORDER], [...DEFAULT_COLUMN_WIDTHS])).toBe(
-      '340px 100px 220px 100px 80px minmax(0, 1fr) 170px'
+      '340px 100px 220px 100px 80px minmax(0, 1fr) 170px 32px'
     );
     expect(getColumnGridColumn('Date Added', [...DEFAULT_COLUMN_ORDER])).toBe('7');
     expect(getColumnGridColumn('Date Added', ['Date Added', ...DEFAULT_COLUMN_ORDER.slice(0, -1)])).toBeUndefined();

src/utils/downloadTableColumns.ts

@@ -14,6 +14,7 @@ export const DEFAULT_COLUMN_ORDER = [
 
 export const DEFAULT_COLUMN_WIDTHS = [340, 100, 220, 100, 80, 170] as const;
 export const COLUMN_MINIMUMS = [160, 58, 92, 58, 48, 144] as const;
+export const DOWNLOAD_ACTIONS_COLUMN_WIDTH = 32;
 
 export const COLUMN_WIDTHS_STORAGE_KEY = 'firelink-download-column-widths';
 export const COLUMN_ORDER_STORAGE_KEY = 'firelink-download-column-order';
@@ -98,6 +99,7 @@ export const buildColumnGridTemplate = (
     ...orderedWidths.slice(0, -1).map(width => `${width}px`),
     'minmax(0, 1fr)',
     `${orderedWidths[orderedWidths.length - 1]}px`,
+    `${DOWNLOAD_ACTIONS_COLUMN_WIDTH}px`,
   ].join(' ');
 };
 

src/utils/keychainStartup.ts

@@ -18,9 +18,10 @@ export type KeychainAccessReadiness = {
 };
 
 // The semantic app version can remain unchanged across release-candidate and
-// packaging rebuilds. Use the build identity so an updated binary cannot skip
-// Firelink's explanation and invoke the OS prompt directly. The policy epoch
-// remains only as a safe fallback for builds created outside the Git checkout.
+// packaging rebuilds. The Tauri packaging hook appends a fresh artifact nonce
+// to the build identity, so replacing the binary cannot skip Firelink's
+// explanation and invoke the OS prompt directly. The policy epoch remains
+// only as a safe fallback for builds created outside the Git checkout.
 const KEYCHAIN_CONSENT_POLICY_VERSION = '2';
 const buildId = typeof import.meta.env.VITE_BUILD_ID === 'string'
   ? import.meta.env.VITE_BUILD_ID.trim()