docs+chore: refresh README/STATE, cache electron in CI, lock chord by keycode, misc P3

- README: add lock-screen section, refresh test list (13 offline tests),
  updater fallback order, data locations, architecture tree
- STATE.md: v1.0.20, current release.cjs flow (no --skip-github), M11-M13
- ci.yml: actions/cache for the ~100MB Electron binary keyed on lockfile
- .gitignore: ignore .env.* but keep committed templates
- scripts/archive-releases.cjs moved in from tmp-test; KEEP_TAG is now a
  required CLI arg (a hardcoded default is how the wrong version gets wiped)
- lockShortcuts: isPanicLockChord matches input.code ('KeyL') so Dvorak and
  non-Latin layouts trigger Ctrl+L lock correctly
- settings: drop the dead single-option update-channel Select from About tab
- Workspace/App: memo(IconRail/LayoutFlyout), useMemo layoutMenu keyed on
  language, useCallback onOpenSettings; drop unused IconRail onSplit prop

.gitignore

@@ -17,6 +17,11 @@ research/
 
 # credentials (do not commit)
 .env
+# .env.* too, but never the committed templates
+.env.*
+!.env.example
+!.env.sample
+!.env.template
 
 # ts build info
 *.tsbuildinfo
@@ -30,6 +35,7 @@ tests/.lock-store.cjs
 tests/.lock-controller.cjs
 tests/.lock-shortcuts.cjs
 tests/.settings-store.cjs
+tests/.local-path-grants.cjs
 tests/.session-e2e.cjs
 tests/.hl-split-smoke.cjs
 tests/.hl-rules.cjs