merge: bring main (v1.7.125 + .126 work) into phase-13 branch pre-deploy

63 main commits since the fork point — gate cookie-strip fix, named-volume
create fix, appgate catalog classification, RNode error surfacing — merged
so 13-14/13-15 on-device verification runs against current production code.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/release/run.sh

@@ -62,6 +62,7 @@ summary() {
 # ── Stage 1: static ──────────────────────────────────────────────────
 stage "git-diff-check"   git diff --check
 stage "cargo-fmt"        timeout 240 cargo fmt --manifest-path core/Cargo.toml --all --check
+stage "manifest-shell"  python3 scripts/check-manifest-shell.py
 stage "catalog-drift"    python3 scripts/check-app-catalog-drift.py --release --strict
 # Every release must surface its CHANGELOG entry in the Settings "What's New"
 # modal. The modal hardcodes a block per version and has drifted behind before