[sanskarIN]

Purpose

Prepare RepoDNA v1.4.3 for a stable GitHub release. The candidate remains unpublished until all release gates pass.

Integrated scope

• Merge feat(web): filter Files explorer by generated, vendored, binary and skipped state #103: Files explorer state filters (generated, vendored, binary, skipped and ordinary).
• Merge fix(web): protect CSV cells with formula prefixes hidden by whitespace #104: protect CSV exports against formulas hidden behind whitespace and control characters.
• Merge feat(web): export the current filtered findings as a safe CSV #102: export the complete currently filtered Findings list to spreadsheet-safe CSV (CI and CodeQL passed).
• Preserve the centered 1100 × 720 resizable Windows desktop startup window and the offline What's New experience.
• Stage the 1.4.3 npm, Rust, desktop/Tauri and lockfile versions plus dated release notes.
• Integrate current main including the export and security changes at 7a104131989c06de558931d9c64791118a7bf5cf.

Publication handoff

• Add .github/workflows/finalize-v143.yml to run exactly once when merged into main.
• Wait for post-merge CI and CodeQL, run a full unpublished Release workflow trial on the exact commit, refuse to tag if main moved, then create the immutable v1.4.3 tag and dispatch the existing release workflow.
• GitHub Actions is the publisher; merging this PR authorizes that gated sequence, not immediate publication before validation.

Validation status

• Integrate feat(web): export the current filtered findings as a safe CSV #102, feat(web): filter Files explorer by generated, vendored, binary and skipped state #103 and fix(web): protect CSV cells with formula prefixes hidden by whitespace #104 into main, with their checks passing.
• Reconcile desktop window settings and stage complete release notes.
• Complete the separate Windows v1.4.3 Review (Unpublished) preview workflow (x64/ARM64 installers and portable CLIs); this is an earlier preview SHA, not the final release trial.
• Complete CI and CodeQL Advanced on the exact final release candidate head.
• Run the Release workflow manually with empty tag as an unpublished trial on the exact final candidate commit; inspect every platform asset, checksums, WASM, npm packages and WinGet manifests.
• Verify release metadata consistency and official support links at the final tag.
• Merge this PR into main, tag that exact verified merge commit v1.4.3, and verify the tag-triggered publication job and stable assets.

Do not publish or announce a stable v1.4.3 release until the final validation and publication have succeeded.