docs+chore: refresh README/STATE, cache electron in CI, lock chord by keycode, misc P3

- README: add lock-screen section, refresh test list (13 offline tests),
  updater fallback order, data locations, architecture tree
- STATE.md: v1.0.20, current release.cjs flow (no --skip-github), M11-M13
- ci.yml: actions/cache for the ~100MB Electron binary keyed on lockfile
- .gitignore: ignore .env.* but keep committed templates
- scripts/archive-releases.cjs moved in from tmp-test; KEEP_TAG is now a
  required CLI arg (a hardcoded default is how the wrong version gets wiped)
- lockShortcuts: isPanicLockChord matches input.code ('KeyL') so Dvorak and
  non-Latin layouts trigger Ctrl+L lock correctly
- settings: drop the dead single-option update-channel Select from About tab
- Workspace/App: memo(IconRail/LayoutFlyout), useMemo layoutMenu keyed on
  language, useCallback onOpenSettings; drop unused IconRail onSplit prop

src/shared/i18n/dicts/zh-CN/settings.ts

@@ -291,7 +291,6 @@ const settings: Record<string, string> = {
   'settings.about.statusDownloaded': '下载完成，可重启安装',
   'settings.about.statusError': '检查失败',
   'settings.about.statusDev': '开发模式不支持更新检查',
-  'settings.about.channelStable': '稳定更新通道',
   'settings.about.autoCheck': '启动时自动检查',
   'settings.about.download': '下载更新',
   'settings.about.downloadGithub': '（GitHub 源）',