test: the noise probe reads the de-noise node, and the math probe builds one

The probe gains a staged chain rather than one phase, and the schedule moves with it:
`UDPSCOPE_PROBE_NOISE_MS` now times the *setup* stage, which installs the de-noise graph through
`apply_math_channels()` -- a structural rebuild that replaces the buffer and drops its history --
five seconds before anything scans it. The legs and the five measurements then run at about
10.5 s, and the reading that says the median rejected every impulse at 15.5 s, so the documented
run needs a 20 s mock and an 18 s exit.

The de-noise channel is installed **disabled** and enabled only at 13 s, for its own reading. An
acquired channel is a share of the ring, so a fifth one shortens every channel's retained span --
and the six `BufferSearch` leg counts and `pkpk bare` are all peaks and counts *of that window*.
Installing it enabled (as the plan had it) moved `bare` from 49 to 21, `ratio` from 7.00 to 3.00
and `pkpk bare` from 2.988 to 2.488, i.e. it would have rewritten the older feature's documented
proof to record a regression that is not one. With it enabled only at the end, every reading from
Tasks 4 and 8 is bit-for-bit what the doc records, and the new line reads
`denoise raw=2.987696/1 denoised=2.000000/1 ratio=0.669 channels=1` -- `denoised` exactly the
clean sine's 2.0, which is the claim the node makes.

Two other findings, both folded in: a derived channel whose source is switched off through the
panel's checkbox follows it off and does *not* come back when the source returns (the enable-all
probe's last act switches `sine` off at ~3 s), and the probes reload leftover math channels from
`$XDG_CONFIG_HOME/udpscope`, which is why a `setup channels=` count above 1 means an earlier run's
session, not a defect.

`math_probe` gains a third channel with a `DeNoise` node so the editor's median row is built and
synced on a baseline run: `3 math channels on 'sine' and 'noise'`, every other line as before,
`math cost: 103.3 ns/slot` (one reading of the same path).

verification.md: the recipe, and why the two stages may not be collapsed -- a probe that rebuilt
the buffer under its own legs reads `bare=0` and looks like a broken comparator. Also that the
noise and math probes may not share a run: both write `app.math`.

src/ui.cpp

@@ -5423,7 +5423,10 @@ int run_ui(int argc, char** argv, const Config& cfg, ScopeModel& model, Acquisit
     g_timeout_add(static_cast<guint>(std::atoi(env)), drop_probe, &app);
   }
   if (const char* env = g_getenv("UDPSCOPE_PROBE_NOISE_MS")) {
-    g_timeout_add(static_cast<guint>(std::atoi(env)), noise_probe, &app);
+    const int ms = std::atoi(env);
+    // Times the *setup* stage; `noise_probe` runs 5000 ms after it, so 3000 puts the legs at the same
+    // 8000 ms they were measured at.
+    if (ms > 0) g_timeout_add(static_cast<guint>(ms), noise_probe_setup, &app);
   }
   if (const char* env = g_getenv("UDPSCOPE_PROBE_ROWMENU_MS")) {
     rowmenu_probe_next(app, 0, static_cast<guint>(std::atoi(env)));