docs+chore: refresh README/STATE, cache electron in CI, lock chord by keycode, misc P3

- README: add lock-screen section, refresh test list (13 offline tests),
  updater fallback order, data locations, architecture tree
- STATE.md: v1.0.20, current release.cjs flow (no --skip-github), M11-M13
- ci.yml: actions/cache for the ~100MB Electron binary keyed on lockfile
- .gitignore: ignore .env.* but keep committed templates
- scripts/archive-releases.cjs moved in from tmp-test; KEEP_TAG is now a
  required CLI arg (a hardcoded default is how the wrong version gets wiped)
- lockShortcuts: isPanicLockChord matches input.code ('KeyL') so Dvorak and
  non-Latin layouts trigger Ctrl+L lock correctly
- settings: drop the dead single-option update-channel Select from About tab
- Workspace/App: memo(IconRail/LayoutFlyout), useMemo layoutMenu keyed on
  language, useCallback onOpenSettings; drop unused IconRail onSplit prop

.github/workflows/ci.yml

@@ -24,10 +24,20 @@ jobs:
           node-version: 22
           cache: npm
 
+      # `npm ci` triggers electron's postinstall, which downloads the ~100MB
+      # binary into %LOCALAPPDATA%\electron\Cache. Keyed on the lockfile so any
+      # dependency bump — electron included — refetches instead of restoring a
+      # binary that no longer matches the pinned version.
+      - name: Cache Electron binary
+        uses: actions/cache@v4
+        with:
+          path: ~/AppData/Local/electron/Cache
+          key: electron-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+
       - name: Install dependencies
         run: npm ci
 
-      # npm test 会先自动跑 pretest（typecheck），再重建 esbuild bundle 并跑 10 个离线测试
+      # npm test 会先自动跑 pretest（typecheck），再重建 esbuild bundle 并跑 13 个离线测试
       - name: Test
         run: npm test