chore: land the remaining low-severity items from the whole-project review

Phase 11 of PROJECT_REVIEW_PLAN.md: the themed cleanup pass over every
low-severity finding still open (2.2-2.3, 3.4-3.6, 4.3-4.7, 6.4-6.7,
7.1-7.3, 8.2-8.3, 9.1-9.4, and the under-documented decisions in §10/§11).

Behavioral fixes:
- Reassign duplicate job IDs in a hand-edited jobs.json instead of letting
  two jobs share one runtime, schedule entry, and SeedStats bucket.
- Disambiguate run-log file names that collide within the same second.
- Compute AvgDurationMS as DurationSumMS/TimedRunCount instead of an
  incremental integer mean, so it always matches the seeded-from-logs
  average instead of drifting from truncation error.
- Clean absolute paths in ResolveConfiguredPath so two spellings of the
  same jobs file do not trigger a spurious adoption.
- Report InstallDesktopIcon failures through ErrorOccurred instead of
  discarding them silently.
- Move settingsView's blocking AutostartStatus (PowerShell on Windows) off
  the UI thread.
- Give notify-timing.tsv its own extension so CleanupLogs no longer
  manages it as a run log.
- Replace the settingsView Save handler's second copy of validateConfig's
  rules with a bare parse, letting the Service's own error surface.

Cleanups:
- Delete collectActivity, the dead yaml tags on RunRecord, and the
  logArguments/LogArguments alias.
- Fold the two systemTrayRegistered/mainWindowHidden globals into one
  trayState instance Run owns and threads through Settings and the
  single-instance reveal path.
- Fix stale comments/docs: the frozen window-size restore claim, a
  reference to a renamed recordRun, README's "Pause all" and notification
  wording, the PowerShell quoting note for TESTS.md's coverage command,
  and scripts/test.bat's UTF-8 checkmarks under a non-UTF-8 code page.
- Document the single-instance fallback's consequence and the
  unauthenticated instance-channel port in STANDARDS.md; record the
  config-shim retirement plan in ROADMAP.md.

3.5, 7.3, and 9.4 turned out to already be fixed by earlier phases; no
change needed for those three.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/STANDARDS.md

@@ -121,6 +121,22 @@ change to their shape has to stay compatible on its own.
   an occurrence that fired before the pause/disable. The details pane appends
   ", N queued" to the statistics line via `DisplayStats` whenever the count is
   non-zero.
+- **Single-instance arbitration falls back to "start anyway" when the port is
+  held by something else.** `acquireSingleInstance` (`singleinstance.go`)
+  binds `127.0.0.1:37653`; if that fails and a dial to the same address does
+  not answer as GoSentry either, startup continues rather than refusing to
+  open because of an unrelated local listener. The consequence is deliberate
+  but worth spelling out: two GoSentry processes can then run two schedulers
+  against the same `jobs.json` and the same logs directory, each overwriting
+  the other's saves. Atomic writes (`writeFileAtomic`) prevent a *torn* file
+  from a concurrent write, but not one process's save clobbering the other's.
+- **The single-instance channel is an unauthenticated localhost TCP port.**
+  Port 37653 accepts one command, `"show"`, from any local process — including
+  one running as a different user on a shared machine. This is a deliberate
+  scope choice, not an oversight: the command only raises the existing window,
+  so the impact of an unwelcome sender is a window popping up, not data
+  exposure or control. Anything with a larger blast radius on that channel
+  would need real authentication.
 
 ## Out of scope