feat: the manual is a Mallard set opened in Yelp, not a GResource in the binary

The help was 14 Pango-markup `.txt` bodies in a second GResource, drawn into a paged `GtkWindow`
built in `help_window.cpp`. That made F1 a viewer of ours with no search index, no cross-references
and no translation, and it kept the manual in the *binary* when every other desktop application's is
a document on disk. It is now a real Mallard set:

  help/C/org.udpscope.app/  index.page + 14 topic pages + figures/*.png

and `show_help()` hands `help:org.udpscope.app` to whatever the desktop registered for the `help:`
scheme -- Yelp on GNOME -- through a `GtkUriLauncher`, reporting a launch failure with a
`GtkAlertDialog` rather than a click that silently does nothing. The paged window's builder, the
page table and `help_self_check()`'s markup validation are gone with the resource.

The document identifier is the desktop file's own basename (its desktop-file id), derived in
CMakeLists from `data/org.udpscope.app.desktop.in`, so the same string is the `.desktop` name, the
GApplication id and the install directory at once. The set is installed by a new `install()` rule to
`<datadir>/help/C/org.udpscope.app/` -- where the freedesktop Help System Specification's `help:`
URI resolves `help:<id>` -- so the manual is read from a datadir by another process even though the
binary has no install step. `UDPSCOPE_HELP_NAME` and `UDPSCOPE_HELP_DIR` are compiled in from that
one place.

The 14 pages were migrated fact for fact, but restructured the Mallard way: a `<desc>` per page
(what a search result shows), `<steps>` for procedures, `<terms>` for option lists,
`<gui>`/`<key>`/`<keyseq>` for interface words and keys, `<note>` for the asides, and a topic graph
via `<link type="guide" xref="index#main"/>`. The figures are annotated screenshots produced by
`tools/make-help-shots.sh`, which drives the app headlessly against `tools/mock_udpstreamer.py` and
draws the boxes with ImageMagick; the side panel's box is measured from the app's own `side=NNNx`
dump reading, the header and status bands come from a documented table, and a crop whose standard
deviation is 0 fails the script.

`cmake --build build --target test-help` checks the set the way `test-ui` checks the `.ui` files:
`yelp-check`'s offline subcommands (links, media, orphans, ids) and a `yelp-build html` render.
`yelp-check validate` is deliberately absent -- it fetches the Mallard RelaxNG schema over the
network and fails offline for that reason, not for a fault in the pages.

The `[help]` probe reading changes with the resource it was written for. `parsed == pages` over
in-binary markup cannot exist now, so `help_self_check()` scans `UDPSCOPE_HELP_DIR` and the line
reads `topics=14 index=1 figures=3`; `topics=0 index=0` is the manual missing from the tree, which
is the finding the old count named.

Verified: clean build with the documented three warnings (the help bundle's `-Woverlength-strings`
is gone, so the baseline moves from four to three); test-ui 14/14; test-help clean (the four
subcommands and 15 pages rendered); a temp-prefix install lands 15 `.page` files and 3 figures at
`share/help/C/org.udpscope.app/`; the headless run reads `[help] topics=14 index=1 figures=3 dir=...`
with 0 Gtk-CRITICAL. Yelp's own window could not be exercised on this box -- it starts under Xvfb,
activates its portals and never maps, the same WebKit/portal limitation that stops a grab -- so its
rendering and its search index are unverified here; the content pipeline was (`yelp-build` renders
the whole set).

Docs: the manual's build/install/open story in `build-and-run.md` and README; the warning baseline
in `verification.md`/CLAUDE.md; the help bullets in `invariants-gtk-and-chrome.md`; the `[help]`
line in `probe-readings.md`.

docs/claude/verification.md

@@ -13,21 +13,21 @@ xvfb-run -a env UDPSCOPE_EXIT_AFTER_MS=8000 UDPSCOPE_ENABLE_ALL_MS=1000 \
   ./build/udpscope --server 127.0.0.1 --port 8000
 ```
 
-Two baselines every run is read against. A clean build emits **four** warnings and no more: two
-`-Wmissing-field-initializers` on `MathNode::source` and `-Woverlength-strings` on **both**
-generated GResource `.c` files — the help pages' (**516044** bytes) and the icons', whose blob is
-**12352** against C99's 4095-byte string-literal limit with the seven action icons and the two app icons
-that remain (a note about a generated file, which GCC itself supports) -- re-measured when
-the tab work changed the set (that icon left, the two tab glyphs arrived, and this file's
-help page was rewritten), which did not move the count; re-measure by touching each `*.gresource.xml`
-under `src/` and rebuilding. The fifth warning that used to appear here was an unused
+Two baselines every run is read against. A clean build emits **three** warnings and no more: two
+`-Wmissing-field-initializers` on `MathNode::source` and one `-Woverlength-strings` on the icons'
+generated GResource `.c`, whose blob is **12352** against C99's 4095-byte string-literal limit with
+the seven action icons and the two app icons that remain (a note about a generated file, which GCC
+itself supports). The *fourth* was the help pages' generated `.c` (**516044** bytes); the manual is
+now a Mallard set installed for Yelp rather than a GResource compiled into the binary, so that
+bundle — and its warning — is gone, and the baseline moved from four to **three**. Re-measure by
+touching each `*.gresource.xml` under `src/` and rebuilding; a third `-Wmissing-field-initializers`
+or any other warning is a finding. (The fifth warning that used to appear here was an unused
 `output_built` in `math_probe()`; it was **deleted** as dead code — redundant with the
-`output_after_add` already printed on the same line — and that deletion is what dropped the baseline
-from five to four. Nothing started reading it. And an exit-dump run emits **no** `Gtk-CRITICAL` at
-all. A fifth warning, or any critical, is a finding.
+`output_after_add` already printed on the same line — which dropped the baseline from five to
+four.) And an exit-dump run emits **no** `Gtk-CRITICAL` at all.
 
-An *incremental* build reads **two** of those four: the generated GResource `.c` files are not
-recompiled when only `src/` changed, so their `-Woverlength-strings` do not reappear.
+An *incremental* build reads **one** of those three: the generated GResource `.c` is not recompiled
+when only `src/` changed, so its `-Woverlength-strings` does not reappear.
 
 A third reading every run offers for free: **how many `[udpscope] buffer allocated:` lines it
 printed.** The line is not behind a probe — it is in every build — and one line is one *real* change
@@ -39,7 +39,8 @@ That second baseline used to be "exactly two, `gtk_widget_get_height` and `gtk_w
 from the dump asking a destroyed widget for its size", and tolerating them was a mistake: the dump
 runs from the destroy handler, so the widget pointer is **freed memory**, and a critical is only
 the lucky reading of it. A run that had built and destroyed other windows first —
-`UDPSCOPE_PROBE_HELP_MS`, which opens three — has had that memory reused, and the same two calls
+`UDPSCOPE_PROBE_HELP_MS`, which opens the About and shortcut dialogs and then closes them — has had
+that memory reused, and the same two calls
 then **SIGSEGV in the middle of the dump**, which reads as a truncated dump rather than as a
 crash in a debug line. Every size the dump prints is therefore captured on the *tick*, while the
 window is alive (`App::dbg_*`), and **no `gtk_widget_*` call may appear in the dump** — the