[BUG] Windows desktop: file preview & download broken — preview window base-URI blocked by app's own CSP (base-uri 'none')

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary
On the current Windows desktop build, clicking any presented/generated file throws an "unable to open file" alert, and the download button does nothing. Root cause is visible in the app's own logs: the file-preview window's attempt to set its base URI is being blocked by the build's Content Security Policy.
Evidence (from %LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\logs\unknown-window.log, logged on every file-open attempt):
[error] Setting the document's base URI to 'https://claude.ai/' violates the following Content Security Policy directive: "base-uri 'none'". The action has been blocked.
The preview window can't initialize, so the preview fails ("unable to open file") and the download handoff that rides on it fails too.
Impact / scope
Reproduces identically on two separate machines, both fresh and heavily-used installs. Because the CSP is compiled into the build rather than being environment-specific, this likely affects every user on this build — file open and download are core functions.
Environment

OS: Windows 11 Pro N (reproduced on two separate N machines)
Package: Claude_1.22209.0.0_x64__pzs8sxrjxfjjc (MSIX)
WebView2 runtime: 150.0.4078.65 (current)

What Should Happen?

Clicking a presented or generated file should open its preview in the app, and the download button should save the file to the Downloads folder. Both should work without error. Instead, opening throws "unable to open file" and download does nothing — because the preview window's base-URI is blocked by the build's CSP (base-uri 'none'), per the app logs.

Error Messages/Logs

%LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\logs\unknown-window.log, logged on every file-open attempt):  [error] Setting the document's base URI to 'https://claude.ai/' violates the following Content Security Policy directive: "base-uri 'none'". The action has been blocked.

Steps to Reproduce

Open the Windows desktop app.
Have Claude present or generate any file.
Click the file to open it → "unable to open file"; click download → nothing.

Ruled out (all verified not the cause)
WebView2 current; Downloads folder is a valid local path; standard (non-built-in-Administrator) account; Controlled Folder Access off; MSIX re-register attempted; reinstall = identical package. The only signal that tracks the failure is the CSP base-uri block above.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

1.22209.0.0

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

Please review the preview window's CSP base-uri directive in the current build — it appears to have regressed to 'none', breaking file preview and download for all users on this version.