Target security model

Load managed assemblies only from validated local version directories, never directly from UNC.
Hash every packaged file with SHA-256 before activation.
Validate package paths against traversal and package-root escape.
Forbid Autodesk runtime DLLs in packages.
Detect Autodesk installations through a read-only registry abstraction with configuration override for diagnostics.
Do not change TRUSTEDPATHS, registry, profiles or production deployment without explicit approval.
Keep credentials/secrets out of source, manifests and telemetry.