fix code-review findings in the source-chooser feature

Seven correctness and documentation fixes found in the final review:

- `known_sources()`: check the strtol end pointer and add a round-trip
  guard so a filename that layout_path() could not have produced is
  rejected; without it `foo_8000x.toml` listed as `foo:8000` whose `x`
  would unlink `foo_8000.toml`, a different configured session.
- `chooser_finish()`: destroy the form window before the chooser window;
  a row click or Escape while the form was up left a window whose handlers
  pointed at a dead stack frame (latent use-after-free).
- `choose_source()`: keep the pick_probe timeout id and g_source_remove
  it after the loop; a row picked before the delay elapsed left an armed
  source on the main context pointing at the gone frame.
- `chooser_populate()`: replace a false comment ("not a GtkListBoxRow")
  with the truth — GTK4 auto-wraps, but the wrapped row carries no
  source-index data so the bounds check refuses it.
- `pick_probe()`: collapse the duplicate `known.empty()` / `row==nullptr`
  guards; the second was unreachable and two identical lines for one cause
  makes probe output ambiguous.
- `save_layout()`: state the TOML rule directly in the multicast/interface
  comment rather than cross-referencing the adjacent enabled comment.
- `save_layout_now()`: refuse to write when signals() is empty; a run
  against a dead port receives no CONFIG, so every slot name is empty and
  the save would overwrite a configured session with signals=["",...],
  which the chooser filter refuses, silently removing that source from
  the only list it can be picked from.
- Fix include order in layout_store.cpp (<cstdio> before <cstdlib>).
- Update CLAUDE.md and README.md to document the empty-signals guard and
  fix the probe-output quote to match the emitted text exactly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/layout_store.cpp

@@ -5,8 +5,8 @@
 
 #include <algorithm>
 #include <cstdint>
-#include <cstdlib>
 #include <cstdio>
+#include <cstdlib>
 #include <dirent.h>
 #include <fstream>
 #include <sstream>
@@ -134,15 +134,22 @@ std::vector<KnownSource> known_sources() {
     // may hold them too and a first-match split would return a host cut in half.
     const std::size_t cut = stem.rfind('_');
     if (cut == std::string::npos || cut + 1 == stem.size()) continue;
-    const long port = std::strtol(stem.c_str() + cut + 1, nullptr, 10);
-    if (port <= 0 || port > 65535) continue;
+    char* end = nullptr;
+    const long port = std::strtol(stem.c_str() + cut + 1, &end, 10);
+    if (end == nullptr || *end != '\0' || port <= 0 || port > 65535) continue;
+    const std::string host = stem.substr(0, cut);
+    // The name must be one `layout_path()` could have written, or the `×` -- which rebuilds it
+    // through `layout_path()` -- would unlink a different session. `sanitize()` is idempotent on
+    // any host that already came back out of a filename, so this is also true for hosts whose names
+    // contain `_` from the sanitizer.
+    if (sanitize(host) + "_" + std::to_string(port) != stem) continue;
 
     LayoutState st;
     const std::string path = dir + "/" + name;
     if (!load_layout(path, st)) continue;
 
     KnownSource s;
-    s.host = stem.substr(0, cut);
+    s.host = host;
     s.port = static_cast<std::uint16_t>(port);
     s.multicast = st.multicast;
     s.interface_addr = st.interface_addr;
@@ -385,7 +392,9 @@ bool save_layout(const std::string& path, const LayoutState& state) {
   o << "# udpscope session layout (written by the app; safe to edit)\n";
   if (state.window_s > 0.0) o << "window_s = " << state.window_s << "\n";
   o << "plots = " << state.rows.size() << "\n";
-  // Top level, before any table, for the same reason as `enabled` below.
+  // Top level, before any table. A bare key written after a `[[table]]` header belongs to that
+  // table in TOML, which is exactly how `enabled` was once parsed into the last `[[calibration]]`
+  // record and silently lost.
   if (!state.multicast.empty()) o << "multicast = " << toml_escape(state.multicast) << "\n";
   if (!state.interface_addr.empty()) {
     o << "interface = " << toml_escape(state.interface_addr) << "\n";