fix(widget-dev): say which check refused a folder at a restart, and the real limits of the folder id

[mrgoonie]

Makes the remade-folder copy and the folder-id docs precise, as the isolated review of #660 asked.

Root-refused now says which check refused the folder. A session stopped as root-refused at a restart keeps the start check's code in a new optional stopCode field (session store and WidgetDevSessionView):

• ROOT_NOT_OWNED: Clark is no longer allowed to watch the folder on its own, for example a chosen folder deleted and made again. The status line, the develop card row and the tool description still say to choose the folder again with /develop (or copy the project into the widget workspace).
• ROOT_NOT_LOCAL / ROOT_IN_DATA_FOLDER: the folder now resolves to a network share or device path, or into the data folder. Choosing it again is refused too, so the copy says that and asks the person to copy the project into the widget workspace or another local project folder. The card row offers no Develop again button, because that press could only fail.
• No code (a session stopped by an earlier version) or an unknown code: a general line that holds for every case.

stopCode is optional and typed as a string. A missing code (a session stopped by an earlier build) or one this client does not know falls back to the general line. widgetDevRootRefusedCode in contracts maps a view to a known code. The client parses the session view with a strict schema, so it does not ignore unknown fields: the client and node ship as one build. The code is what that restart found and is not re-checked while the session stays stopped. A press re-checks the folder.

Downgrade caveat. sessions.json is also parsed strictly. If an older build reads a store that holds stopCode (or chosenFolderId from #641), it moves the whole file aside as sessions.json.unreadable-<time> and starts with no sessions. Nothing in the file is lost, but it has to be moved back by hand once a newer build runs. docs/open-interfaces(.vi).md now says this.

Review round:

• Merged origin/main (with fix(contracts): let the manifest reader skip facet kinds it does not know #653) and re-ran --fix-manifest.
• The tool now says "develop again; if refused, copy" when there is no known code, which matches the status line and the card. A test covers it.
• The restart test asserts that stopCode and stopReason are cleared on a new start.
• Reworded "which is not developed from" and "failed the check a start makes" in EN and VI.

Docs (docs/open-interfaces(.vi).md, docs/widget-development(.vi).md, the devRootIdentityOf comment in core):

• Drops "at once": ext4 can hand a freed inode back much later, for example to a git clone into the same path the next day.
• Adds that on Windows, FAT32 and exFAT drives can give a remade folder the same id, and that nothing holds the folder open there.
• Replaces "may no longer watch" with "is no longer allowed to watch".
• Documents stopCode.
• Re-wraps the inserted paragraphs, including the Vietnamese ones.

Official docs: digitopvn/clarkcant-web#144

Verification

• New and changed tests fail on main and pass here: apps/runtime/test/widget-dev-root-refused.spec.ts (new), packages/conversation-client/test/widget-dev-status.spec.ts, and the two restart tests in apps/runtime/test/widget-dev-sessions.spec.ts.
• pnpm verify passes (invariants, typecheck, lint, test). The docs manifest was refreshed with --fix-manifest.

Fixes #662
Refs #643, #660

[mrgoonie]

Review attestation: ready to merge at 1f07602371e4b268aa35eeb974abd652f0d3f4bd, reviewed by agent:code-reviewer.

A push to this PR makes this attestation stale; the new head needs its own review.