fix code-review findings in the source-chooser feature

Seven correctness and documentation fixes found in the final review:

- `known_sources()`: check the strtol end pointer and add a round-trip
  guard so a filename that layout_path() could not have produced is
  rejected; without it `foo_8000x.toml` listed as `foo:8000` whose `x`
  would unlink `foo_8000.toml`, a different configured session.
- `chooser_finish()`: destroy the form window before the chooser window;
  a row click or Escape while the form was up left a window whose handlers
  pointed at a dead stack frame (latent use-after-free).
- `choose_source()`: keep the pick_probe timeout id and g_source_remove
  it after the loop; a row picked before the delay elapsed left an armed
  source on the main context pointing at the gone frame.
- `chooser_populate()`: replace a false comment ("not a GtkListBoxRow")
  with the truth — GTK4 auto-wraps, but the wrapped row carries no
  source-index data so the bounds check refuses it.
- `pick_probe()`: collapse the duplicate `known.empty()` / `row==nullptr`
  guards; the second was unreachable and two identical lines for one cause
  makes probe output ambiguous.
- `save_layout()`: state the TOML rule directly in the multicast/interface
  comment rather than cross-referencing the adjacent enabled comment.
- `save_layout_now()`: refuse to write when signals() is empty; a run
  against a dead port receives no CONFIG, so every slot name is empty and
  the save would overwrite a configured session with signals=["",...],
  which the chooser filter refuses, silently removing that source from
  the only list it can be picked from.
- Fix include order in layout_store.cpp (<cstdio> before <cstdlib>).
- Update CLAUDE.md and README.md to document the empty-signals guard and
  fix the probe-output quote to match the emitted text exactly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/source_dialog.cpp

@@ -64,6 +64,16 @@ struct Chooser {
 
 void chooser_finish(Chooser& c, bool chosen) {
   c.chosen = chosen;
+  // Destroy the form first: any path that reaches here while the form is up -- a row click, the
+  // Escape key -- would otherwise leave a window whose four handlers are bound to a dead stack
+  // frame. `gtk_window_destroy()` rather than `gtk_window_close()`: the pointer is already
+  // cleared, so the `close-request` handler is not needed here, and `close()` on an unrealized
+  // window returns having done nothing.
+  if (c.form != nullptr) {
+    GtkWidget* w = c.form;
+    c.form = nullptr;  // before the destroy, so the `close-request` handler cannot re-enter
+    gtk_window_destroy(GTK_WINDOW(w));
+  }
   if (c.window != nullptr) {
     GtkWidget* w = c.window;
     c.window = nullptr;  // before the destroy: `close-request` must not re-enter this
@@ -104,7 +114,9 @@ void chooser_populate(Chooser& c) {
     gtk_widget_add_css_class(empty, "dim-label");
     gtk_widget_set_margin_top(empty, 24);
     gtk_widget_set_margin_bottom(empty, 24);
-    // Not a `GtkListBoxRow`, so it cannot be activated into a source that does not exist.
+    // GTK4 auto-wraps any non-row widget appended to a `GtkListBox` in a row, so this is
+    // activatable -- but the wrapped row carries no `"source-index"` data, `g_object_get_data()`
+    // returns null, the index reads 0, and `on_row_activated`'s bounds check refuses it.
     gtk_list_box_append(GTK_LIST_BOX(c.list), empty);
     gtk_list_box_set_selection_mode(GTK_LIST_BOX(c.list), GTK_SELECTION_NONE);
     return;
@@ -310,12 +322,6 @@ gboolean pick_probe(gpointer user) {
     return G_SOURCE_REMOVE;
   }
   GtkListBoxRow* row = gtk_list_box_get_row_at_index(GTK_LIST_BOX(c.list), 0);
-  if (row == nullptr) {
-    std::fprintf(stderr, "[sources] picked nothing: the list is empty\n");
-    std::fflush(stderr);
-    chooser_finish(c, false);
-    return G_SOURCE_REMOVE;
-  }
   // `row-activated`, not `gtk_widget_activate()`: this project has already learned that
   // activating a widget takes a path a real click does not (a `GtkButton` holds for its 250 ms
   // ACTIVATE_TIMEOUT and then emits into a widget a rebuild has destroyed).
@@ -388,14 +394,19 @@ bool choose_source(Config& cfg) {
 
   gtk_window_present(GTK_WINDOW(c.window));
 
+  // Keep the timeout id so it can be cancelled if the chooser finishes before it fires. A row
+  // clicked before UDPSCOPE_PROBE_PICK_MS elapses would otherwise leave an armed source on the
+  // default main context pointing at the now-gone stack frame.
+  guint pick_probe_id = 0;
   if (const char* env = g_getenv("UDPSCOPE_PROBE_PICK_MS")) {
-    g_timeout_add(static_cast<guint>(std::atoi(env)), pick_probe, &c);
+    pick_probe_id = g_timeout_add(static_cast<guint>(std::atoi(env)), pick_probe, &c);
   }
 
   c.loop = g_main_loop_new(nullptr, FALSE);
   g_main_loop_run(c.loop);
   g_main_loop_unref(c.loop);
   c.loop = nullptr;
+  if (pick_probe_id != 0) g_source_remove(pick_probe_id);
   return c.chosen;
 }