fix code-review findings in the source-chooser feature

Seven correctness and documentation fixes found in the final review:

- `known_sources()`: check the strtol end pointer and add a round-trip
  guard so a filename that layout_path() could not have produced is
  rejected; without it `foo_8000x.toml` listed as `foo:8000` whose `x`
  would unlink `foo_8000.toml`, a different configured session.
- `chooser_finish()`: destroy the form window before the chooser window;
  a row click or Escape while the form was up left a window whose handlers
  pointed at a dead stack frame (latent use-after-free).
- `choose_source()`: keep the pick_probe timeout id and g_source_remove
  it after the loop; a row picked before the delay elapsed left an armed
  source on the main context pointing at the gone frame.
- `chooser_populate()`: replace a false comment ("not a GtkListBoxRow")
  with the truth — GTK4 auto-wraps, but the wrapped row carries no
  source-index data so the bounds check refuses it.
- `pick_probe()`: collapse the duplicate `known.empty()` / `row==nullptr`
  guards; the second was unreachable and two identical lines for one cause
  makes probe output ambiguous.
- `save_layout()`: state the TOML rule directly in the multicast/interface
  comment rather than cross-referencing the adjacent enabled comment.
- `save_layout_now()`: refuse to write when signals() is empty; a run
  against a dead port receives no CONFIG, so every slot name is empty and
  the save would overwrite a configured session with signals=["",...],
  which the chooser filter refuses, silently removing that source from
  the only list it can be picked from.
- Fix include order in layout_store.cpp (<cstdio> before <cstdlib>).
- Update CLAUDE.md and README.md to document the empty-signals guard and
  fix the probe-output quote to match the emitted text exactly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -480,7 +480,10 @@ once already. And the list is **filtered to sessions that name a signal**: a dev
 accumulates one file per probe run on a throwaway port — 140 of them here, every one with
 `signals = ["", "", "", ""]` — so an unfiltered chooser opens as a wall of ports nobody chose. A
 row's `×` forgets a source by deleting its session file, with no confirmation: the gesture is the
-confirmation, and what it destroys is one layout the app rewrites on the next clean exit.
+confirmation, and what it destroys is one layout the app rewrites on the next clean exit. A session
+is **not written** when no CONFIG arrived during the run — otherwise a source whose streamer was
+down during one launch would silently vanish from the chooser list because its file was flattened
+to empty signal names, which the filter refuses.
 
 **Math channels.** A math channel is derived from the others by a graph of operations and is then
 an *ordinary channel*: the model synthesises a signal entry for it, so an enabled one is acquired,