Merge branch 'main' into the desktop updater, and give way on two numbers

Main landed a realtime push feature while this branch was building the updater,
and the two collided in three places. Every one of them resolves the same way:
main got there first, so this branch moves.

**Two ADRs were both numbered 0012.** Main's is realtime push; this one is now
[ADR 0013](docs/adr/0013-desktop-distribution-and-updates.md). Git did not call
this a conflict — the filenames differ — so it would have merged quietly and left
the directory with two 0012s and every cross-reference ambiguous. Renumbered here
along with the nine places that point at it.

**Two manual-check phases were both numbered 15**, and that one git did catch.
Main's "Changes that arrive without a timer" keeps 15; installing and updating
the desktop client becomes Phase 16, with its checks and every reference to them
renumbered. The file's own rule is that a number is for life, which is exactly
why the one that had not been pushed is the one that gives way.

**The merge rewrote several files with CRLF**, and `.editorconfig` asks for LF on
everything except `*.ps1`. That is not cosmetic here: IDE0055 is an error and
`EnforceCodeStyleInBuild` is on, so it failed the build on three lines of
App.axaml.cs whose only change in this branch was an ADR number in a comment.
Forty-six files normalised back to LF; the release script keeps CRLF, which is
what `.gitattributes` and `.editorconfig` both already say for a PowerShell file.

Nothing else conflicted. The updater does not touch the sync loop or the event
stream, and the one file both sides edited heavily — MainWindowViewModel — merged
without a hunk in common.

Verified after merging: the solution restores locked and builds clean, and 304
shell, 100 layout, 54 session, 28 client-api and 25 contracts tests pass. The
first two counts are higher than before the merge because main's own tests came
with it and pass alongside these.

scripts/release-windows.ps1

@@ -5,14 +5,14 @@
 .DESCRIPTION
     Run by a person, on a Windows machine that is not a CI runner. That is not an accident of tooling —
     docs/adr/0011-android-distribution.md rule 1 puts the capability to ship somebody a build on a machine
-    which is not a runner, and docs/adr/0012-desktop-distribution-and-updates.md explains why the token that
+    which is not a runner, and docs/adr/0013-desktop-distribution-and-updates.md explains why the token that
     writes a Gitea release is that capability: Velopack clients trust their feed and do not verify a package
     signature when they apply it, so whoever can write a release can ship an update every install runs.
 
     Two phases, and the split is the design rather than a convenience.
 
       1. Without -Upload: builds, packs, and stops. Nothing has left this machine.
-         Install the Setup.exe it names, and walk Phase 15 of docs/manual-checks.md.
+         Install the Setup.exe it names, and walk Phase 16 of docs/manual-checks.md.
       2. With -Upload: asks for the forge token and publishes what phase 1 produced. It does not rebuild,
          so the bytes that reach users are the bytes that were installed and checked.
 
@@ -116,7 +116,7 @@ try {
         }
 
         Write-Host "About to publish the contents of $ReleasesDir to $RepoUrl as $tag."
-        Write-Host 'Only do this once you have installed it and walked Phase 15 of docs/manual-checks.md.'
+        Write-Host 'Only do this once you have installed it and walked Phase 16 of docs/manual-checks.md.'
 
         # Read-Host -AsSecureString so the token is never echoed and never lands in the shell's history.
         $secure = Read-Host -Prompt 'Gitea token (write:repository)' -AsSecureString
@@ -252,7 +252,7 @@ try {
     # run, once per user — Mark-of-the-Web is applied by the browser that downloads Setup.exe, so in-app
     # updates, which this application fetches itself and applies from a local file, never trip it.
     #
-    # This is the one line that changes when a certificate is bought. See ADR 0012 for what it costs and
+    # This is the one line that changes when a certificate is bought. See ADR 0013 for what it costs and
     # what the trigger for buying one is.
     & dotnet vpk pack `
         --packId $PackId `
@@ -274,7 +274,7 @@ try {
         Format-Table -AutoSize
 
     Write-Host 'Next:'
-    Write-Host "  1. Install the Setup executable above and walk Phase 15 of docs/manual-checks.md."
+    Write-Host "  1. Install the Setup executable above and walk Phase 16 of docs/manual-checks.md."
     Write-Host '  2. Then: pwsh -File scripts/release-windows.ps1 -Upload'
 }
 finally {