fix(launcher): Campaign LA LA3 review fixes — contract paths omission, probe composition, graceful stop, hygiene

Opus review of LA3 returned FIX FIRST; this addresses every finding in
scope (F1-F5, F7-F12; F6 CI-lane addition excluded per instructions):

- F1 (CRITICAL): SessionProcessSettings.Paths is now nullable and left
  null by SessionConfigComposer unless a caller supplies overrides, so
  the JSON key is entirely absent instead of "paths":{} — the App-side
  loader's strict UnmappedMemberHandling.Disallow would otherwise reject
  every gui/guiSelect session-config document at load.
- F2: added SessionConfigComposer.ComposeProbe and a nullable
  SessionDescriptor.Mode field ("probe", omitted for normal play) per
  the pinned contract — no character/policy/plugins/loginCommands.
- F3: LauncherProcessSupervisor.Stop now tries
  ILauncherChildProcess.TryRequestGracefulStop (Linux: libc SIGINT via
  LibraryImport, K4-proven graceful headless logout) before
  CloseMainWindow. Windows has no reliable no-window-console equivalent
  today; filed docs/ISSUES.md #397 with the CREATE_NEW_PROCESS_GROUP +
  CTRL_BREAK fix direction. Stop()'s blocking-timeout contract is now
  documented for LA4.
- F4: LauncherProfileStore.Save chmods the Linux temp file to 0600
  immediately after creation, before any credential is serialized;
  failure paths and Load() clean up a stale .tmp.
- F5: added LauncherCoreDependencyBoundaryTests asserting Launcher.Core
  references exactly AcDream.Platform and no packages.
- F7: StatusEventParser.Parse no longer throws on a whitespace/null
  line; StatusFileTailer.ReadNewEvents swallows the File.Exists/open
  TOCTOU window (FileNotFoundException/DirectoryNotFoundException/
  IOException) instead of throwing.
- F8: Start() now kills (entire process tree) and disposes a child that
  started successfully but failed while being fed its stdin password,
  instead of orphaning it.
- F9: SetState is monotonic — once Exited, no later transition applies
  or fires StateChanged, closing a Start()-path race where a
  synchronously-exiting child could be "resurrected" to Running.
- F10: CharacterIdFormat.TryParse now requires the "0x" prefix (an
  unprefixed hand-typed decimal id is also valid hex and was silently
  misread); a parsed id of 0 is treated as unusable and falls back to
  the name selector; LauncherProfileStore.MergeRoster normalizes both
  sides through TryParse/ToHexString instead of raw string equality, so
  a legacy unprefixed-hex row self-heals via name match instead of
  duplicating.
- F11: StatusCharacterEntry.SecondsGreyedOut is now uint, matching
  CharacterRosterEntry and the host writer.
- F12: added MalformedStatusEvent, returned for a recognized `e` whose
  payload doesn't match its shape, distinguished from UnknownStatusEvent
  (an unrecognized `e`).

AllowUnsafeBlocks was added to AcDream.Launcher.Core.csproj — required
by the LibraryImport source generator's function-pointer marshalling
stub for F3's Linux SIGINT P/Invoke.

Verification: dotnet build AcDream.slnx -c Release green (0 errors);
dotnet test tests/AcDream.Launcher.Core.Tests -c Release green at 94/94
on native Windows and under WSL (Ubuntu, verified across multiple runs
for the timing-sensitive SIGINT/sharing-violation tests, no flakes
observed).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.Launcher.Core/Profiles/CharacterIdFormat.cs

@@ -13,6 +13,15 @@ public static class CharacterIdFormat
     public static string ToHexString(uint id) =>
         "0x" + id.ToString("X8", CultureInfo.InvariantCulture);
 
+    /// <summary>
+    /// Parses <paramref name="text"/> as a hex character id — the
+    /// <c>0x</c> prefix (case-insensitive) is REQUIRED (Campaign LA plan
+    /// §LA3 review finding F10). Every all-digit id is ALSO a valid hex
+    /// number (e.g. <c>"12345678"</c>), so accepting a bare unprefixed
+    /// string as hex silently reinterprets a hand-typed decimal id and
+    /// selects the wrong character; requiring the prefix makes "this is
+    /// hex" an explicit, unambiguous signal instead of a guess.
+    /// </summary>
     public static bool TryParse(string? text, out uint id)
     {
         id = 0;
@@ -20,8 +29,10 @@ public static class CharacterIdFormat
             return false;
 
         ReadOnlySpan<char> span = text.AsSpan().Trim();
-        if (span.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
-            span = span[2..];
+        if (!span.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
+            return false;
+
+        span = span[2..];
 
         return uint.TryParse(
             span,

src/AcDream.Launcher.Core/Profiles/LauncherProfileStore.cs

@@ -66,6 +66,13 @@ public sealed class LauncherProfileStore
     /// </summary>
     public bool Load()
     {
+        // Opportunistic cleanup of a stale ".tmp" left behind by a Save()
+        // that crashed between creating the temp file and the atomic
+        // rename (Campaign LA plan §LA3 review finding F4) — a stray
+        // temp file carries the same plaintext credentials as the real
+        // store and should not linger.
+        DeleteStaleTempFile(FilePath + ".tmp");
+
         if (!File.Exists(FilePath))
         {
             Document = new LauncherProfileDocument();
@@ -108,9 +115,16 @@ public sealed class LauncherProfileStore
     /// <summary>
     /// Persists <see cref="Document"/> to <see cref="FilePath"/> via a
     /// write-then-atomic-rename so a crash mid-write never leaves a
-    /// truncated credentials file. On Linux, restricts the final file to
-    /// owner read/write (0600) per Campaign LA's plaintext-credential
-    /// decision (spec §5, decisions log).
+    /// truncated credentials file. On Linux, the temp file is chmod'd to
+    /// owner read/write (0600) immediately after creation — BEFORE any
+    /// plaintext credential is serialized into it — so there is no window
+    /// where the temp file carries the process umask's (potentially
+    /// world/group-readable) default permissions while holding a
+    /// password; the final path gets the same restriction after the
+    /// rename (Campaign LA's plaintext-credential decision, spec §5,
+    /// decisions log; the temp-file window itself is review finding F4).
+    /// A failure between temp-file creation and the rename deletes the
+    /// stale temp file rather than leaving it behind.
     /// </summary>
     public void Save()
     {
@@ -121,12 +135,27 @@ public sealed class LauncherProfileStore
         }
 
         string tempPath = FilePath + ".tmp";
-        using (FileStream stream = File.Create(tempPath))
+        try
         {
-            JsonSerializer.Serialize(stream, Document, SerializerOptions);
-        }
+            using (FileStream stream = File.Create(tempPath))
+            {
+                if (OperatingSystem.IsLinux())
+                {
+                    File.SetUnixFileMode(
+                        tempPath,
+                        UnixFileMode.UserRead | UnixFileMode.UserWrite);
+                }
 
-        File.Move(tempPath, FilePath, overwrite: true);
+                JsonSerializer.Serialize(stream, Document, SerializerOptions);
+            }
+
+            File.Move(tempPath, FilePath, overwrite: true);
+        }
+        catch
+        {
+            DeleteStaleTempFile(tempPath);
+            throw;
+        }
 
         if (OperatingSystem.IsLinux())
         {
@@ -136,6 +165,23 @@ public sealed class LauncherProfileStore
         }
     }
 
+    private static void DeleteStaleTempFile(string tempPath)
+    {
+        try
+        {
+            if (File.Exists(tempPath))
+            {
+                File.Delete(tempPath);
+            }
+        }
+        catch
+        {
+            // Best-effort cleanup only — the caller's own exception (a
+            // failed Save()) or the fresh Load() already in progress is
+            // what matters; a cleanup failure must not mask either.
+        }
+    }
+
     // --- Server CRUD -----------------------------------------------
 
     public ServerProfile AddServer(string name, string host, int port)
@@ -312,16 +358,26 @@ public sealed class LauncherProfileStore
         foreach (CharacterRosterEntry entry in roster)
         {
             string idText = CharacterIdFormat.ToHexString(entry.Id);
-            CharacterProfile? existing = profile.Characters.Find(
-                character => string.Equals(
-                    character.Id,
-                    idText,
-                    StringComparison.OrdinalIgnoreCase));
 
-            // Defensive fallback for a hand-edited file where a character
-            // row was added with a name but no id yet.
+            // Normalize BOTH sides through TryParse/ToHexString rather
+            // than a raw string compare (Campaign LA plan §LA3 review
+            // finding F10): a stored id that round-trips to the same
+            // uint (different case, or — before this fix — no "0x"
+            // prefix) must match even though its text isn't byte-
+            // identical to the canonical form this method itself always
+            // writes.
+            CharacterProfile? existing = profile.Characters.Find(
+                character => CharacterIdFormat.TryParse(character.Id, out uint existingId)
+                    && existingId == entry.Id);
+
+            // Defensive fallback for a row whose id is missing OR
+            // unparseable (e.g. a hand-edited id with no "0x" prefix,
+            // which TryParse now rejects outright) — match by name
+            // instead so a later merge self-heals the id into the
+            // canonical form rather than creating a permanent duplicate
+            // row.
             existing ??= profile.Characters.Find(
-                character => character.Id is null
+                character => !CharacterIdFormat.TryParse(character.Id, out _)
                     && string.Equals(
                         character.Name,
                         entry.Name,