Merge branch 'claude/gallant-brahmagupta-1f8244'

Writes down that locking the vault leaves shells running, and shows the count on
the unlock screen rather than leaving it to be inferred.

Conflict resolution:

- ShellFlowTests' fixture keeps main's FakeSshConnectionFactory. The branch added
  an IdleSshConnectionFactory for exactly what main's fake already does — a shell
  that is open, silent and never closes on its own — so FakeSshConnections.cs is
  dropped rather than merged, leaving one fake SSH stack in the suite instead of
  two that would drift apart.
- MainWindowViewModel and TerminalWorkspace: both sides added their own members,
  so both are kept.
- TerminalWorkspaceTests was added by both branches, with the renderer gate on
  one side and session lifetime on the other. Merged into one class over one set
  of helpers; the gate tests now use FakeConnectionFactory rather than an
  NSubstitute stub, since the suite already has the fake. gallant's polling
  Timeout constant is PollTimeout, which no longer reads as the renderer's.
- platform-flags.md keeps main's measured focus section and drops the short
  "nothing hands the terminal keyboard focus" entry the branch still carried,
  which that section supersedes.

One genuine disagreement between the branches, left visible rather than
flattened: this branch measured that a collapsed WebView cannot be typed into and
attributed it to a hidden WS_CHILD window being ineligible for keyboard focus,
while main's focus work measured Win32 focus still held by that hidden window and
added a lock path that moves the keyboard off it. Both results stand; the
mechanism sentence now defers to the focus entry, which makes the input barrier
something the lock path maintains rather than something the platform guarantees.

Full suite green, including the container-backed SSH tests.

tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs

@@ -644,6 +644,68 @@ public sealed class ShellFlowTests : IAsyncLifetime
         shell.State.ShouldBe(ShellState.Unlocked);
     }
 
+    /// <summary>
+    /// The deliberate half of what Lock does: the vault closes, the shells do not.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// A policy rather than an implementation detail, which is why it is asserted here. Locking is what a
+    /// person does when they walk away from the machine, and that is exactly when a long job is most
+    /// likely to be running — so ending every shell would make Lock destroy work, and an idle auto-lock
+    /// would do it unattended. <c>MainWindowViewModel.LockAsync</c> carries the full argument.
+    /// </para>
+    /// <para>
+    /// The disclosure is asserted along with the behaviour, because the two are the same decision. A
+    /// lock screen that hides the terminal — which it does, the WebView is collapsed while locked — while
+    /// authenticated SSH channels stay open is only defensible if it says so.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task LockingKeepsOpenShellsRunning_AndSaysSoOnTheUnlockScreen()
+    {
+        await UnlockedAsync();
+
+        // Opened on the workspace rather than through Connect. Connect would work here — FakeRenderer can
+        // satisfy the renderer gate — but what is under test is what Lock does to a session that exists,
+        // not how it came to exist, and going through the gate would only add a way for this to fail.
+        await workspace.OpenSessionAsync(
+            new SshConnectionRequest("host.invalid", 22, "dodo", new SshPasswordCredential("irrelevant")),
+            TerminalSize.Default,
+            Token);
+
+        workspace.LiveSessionCount.ShouldBe(1);
+
+        await shell.LockCommand.ExecuteAsync(null);
+
+        shell.State.ShouldBe(ShellState.Locked);
+        shell.Vault.ShouldBeNull("the vault's keys are gone");
+
+        workspace.LiveSessionCount.ShouldBe(1, "the shell was still running, so it kept running");
+
+        shell.HasLiveSessions.ShouldBeTrue();
+        shell.LiveSessionCount.ShouldBe(1);
+        shell.LiveSessionSummary.ShouldBe("1 shell is still connected and still running.");
+
+        // And it survives the unlock too, so the session outlives the whole cycle rather than merely
+        // outliving the disposal.
+        shell.Passphrase = Passphrase;
+        await shell.UnlockCommand.ExecuteAsync(null);
+
+        shell.State.ShouldBe(ShellState.Unlocked);
+        workspace.LiveSessionCount.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task LockingWithNoOpenShells_DisclosesNothing()
+    {
+        await UnlockedAsync();
+
+        await shell.LockCommand.ExecuteAsync(null);
+
+        shell.LiveSessionCount.ShouldBe(0);
+        shell.HasLiveSessions.ShouldBeFalse("an ordinary lock must not warn about nothing");
+    }
+
     // ---- Helpers ----
 
     private static CancellationToken Token => TestContext.Current.CancellationToken;