• feat(security): add Set-ServyExePermissions.ps1 to harden service binaries with explicit Read & Execute rights
• feat(security): update service account documentation and UI to require Set-ServyExePermissions.ps1 hardening
• fix(core): preserve file ACLs across atomic resource extractions in ResourceHelper.cs
• fix(cli): align install command options sequence with core service schema
• test: migrate test runner and coverage collection from VSTest to MTP
• chore(deps): update dependencies
• ci(publish.yml): signed exe injected into Resources without a matching pdb, leaving embedded debug symbols stale for the shipped binary (#5436)