docs+chore: refresh README/STATE, cache electron in CI, lock chord by keycode, misc P3

- README: add lock-screen section, refresh test list (13 offline tests),
  updater fallback order, data locations, architecture tree
- STATE.md: v1.0.20, current release.cjs flow (no --skip-github), M11-M13
- ci.yml: actions/cache for the ~100MB Electron binary keyed on lockfile
- .gitignore: ignore .env.* but keep committed templates
- scripts/archive-releases.cjs moved in from tmp-test; KEEP_TAG is now a
  required CLI arg (a hardcoded default is how the wrong version gets wiped)
- lockShortcuts: isPanicLockChord matches input.code ('KeyL') so Dvorak and
  non-Latin layouts trigger Ctrl+L lock correctly
- settings: drop the dead single-option update-channel Select from About tab
- Workspace/App: memo(IconRail/LayoutFlyout), useMemo layoutMenu keyed on
  language, useCallback onOpenSettings; drop unused IconRail onSplit prop

src/shared/i18n/dicts/en/settings.ts

@@ -307,7 +307,6 @@ const settings: Record<string, string> = {
   'settings.about.statusDownloaded': 'Download complete — restart to install',
   'settings.about.statusError': 'Check failed',
   'settings.about.statusDev': 'Update checks are unavailable in development mode',
-  'settings.about.channelStable': 'Stable channel',
   'settings.about.autoCheck': 'Check automatically at startup',
   'settings.about.download': 'Download update',
   'settings.about.downloadGithub': ' (GitHub source)',