merge: main into P11c (P11a's update/rollback, the bare-launch path, the Linux-only SOCK_CLOEXEC test)

Conflicts: ledger-cli main.rs (kept P11a's is_bare_launch; dropped the
"comes with P11" stubs), ledger-mcp local.rs (main's Linux gate on the
no-other-end test), docs/testing.md (both sections kept). `update` and
`rollback` are cfg(unix) in ledger-host (a running program's file cannot
be replaced on Windows), so main.rs says so on Windows (P11a step 5).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

crates/ledger-mcp/src/local.rs

@@ -2548,8 +2548,9 @@ mod tests {
 
     /// A socket with no other end: the system answers for it (Linux: no
     /// process, no user), and that answer names neither this process nor
-    /// this account; the client's check refuses it.
-    #[cfg(unix)]
+    /// this account; the client's check refuses it. Linux only: the
+    /// answer and `SOCK_CLOEXEC` are Linux's (the portable job found it).
+    #[cfg(target_os = "linux")]
     #[test]
     fn a_socket_with_no_other_end_names_no_process_and_isnt_us() {
         use std::os::fd::FromRawFd;