fix: a clock glitch is bridged and a channel is known by name, so a capture keeps its t0

Two defects behind one report ("a trigger during a capture overrides the first,
and the hold-off does not apply"); the second is also what made a spike in one
channel look like the acquisition resetting.

The trigger engine keyed its invalidation on the trigger channel's *index*, which
every rebuild of the channel list renumbers -- enabling a signal that sorts before
it is enough. Any rebuild therefore abandoned an open capture and set no hold-off,
so the next edge inside the post window became t0. It keys on the channel's name
now, which changes only when the source genuinely does.

A packet whose stamps jump more than 256 packet spans ahead is now rejected as a
fault and *bridged* at the declared cadence, instead of poisoning the monotonic
mark (which pinned every later packet flat at the glitched value) and condemning
the next good packet. Only four consecutive failures abandon the declared time
signal, and that fallback no longer wipes the rings: the arrival clock is anchored
to continue from the monotonic mark, so the history is still on one timeline --
the wipe is what made one glitching packet look like the stream restarting from 0.
The declared unit is resolved before those checks, since they weigh the stamps
against a cadence in seconds.

Guards: UDPSCOPE_PROBE_TRIGRENUM_MS prints t0_held=1 through the real widgets,
and the mock's --time-glitch-at/--time-glitch-by injects the clock fault.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/model.hpp

@@ -285,20 +285,6 @@ class ScopeModel {
   /// is armed.
   BufferStore& live();
 
-  /// Forgets the live buffer's history: every ring is emptied and every channel's
-  /// published window is dropped, so the two stay index-aligned. Used when the
-  /// acquisition has to change time source (see `Acquisition::build_stamps`): the
-  /// stamps already recorded are on the old timeline, and a ring holding two
-  /// timelines is not a time base at all -- the x axis, the crosshair and an export
-  /// all read it by index.
-  ///
-  /// Takes `mutex()` itself: call it from the GTK thread. The acquisition thread
-  /// calls `reset_live_history_locked()` instead, already holding the lock (the
-  /// same split `publish_event()` follows).
-  void reset_live_history();
-  /// The body of the above for a caller that already holds `mutex()`.
-  void reset_live_history_locked();
-
   /// Builds the captured event from the slice of the live buffer covering
   /// `[edge - pre_s, edge + post_s]` in stream seconds, and publishes it atomically.
   /// The stamps are re-based so the edge sits at x = 0. The plot binds to this