feat: install ControlFS from the session menu when it is missing

[lippdev]

What

When ControlFS isn't installed, pressing A on the "File explorer (ControlFS)" row of the session menu now downloads and installs it right there, instead of opening the releases page in the browser.

• Where it comes from: the newest published release of nextestudios/ControlFS (GitHub API), asset ControlFS-Setup-x64.exe. New pure ControlFsRelease.Pick decides: drafts skipped, the setup must carry GitHub's SHA-256 digest and its URL must be under https://github.com/nextestudios/ControlFS/releases/download/. If the newest setup fails those checks nothing is installed (no fallback to an older one).
• How it installs: ControlFsInstaller reuses the updater's download (stall timeout, progress) and UpdateIntegrity.VerifyFileAsync, then runs the Inno setup with /VERYSILENT /SUPPRESSMSGBOXES /NORESTART. ControlFS's installer is per user (PrivilegesRequired=lowest), so no UAC prompt, and it skips its own launch when silent. The downloaded file is deleted afterwards; 5 min timeout on the setup.
• In the menu: the row shows "Downloading… N%" with a bar, then "Installing…" (indeterminate). A second A during the install does nothing. When done, ControlFS opens full screen only if the menu is still open; if the user went back to the game it just stays installed. On failure the row says so and the next A opens the download page; reopening the menu offers the install again.
• Only on demand: nothing is downloaded without the user pressing A on that row.

Strings in the three catalogs, changelogs, manual checks in docs/TESTING.md.

Verification

• Unit tests: 325 pass locally (new ControlFsReleaseTests: newest release, drafts, missing/invalid digest, foreign URLs, odd JSON).
• Built locally on Windows (Debug, win-x64).
• Against the real release: the lookup found 0.17.0-alpha.1, downloaded the 49 MB setup and the SHA-256 matched.
• Not checked: the silent install itself, the row's texts and progress bar, and ControlFS opening at the end (ControlFS was already installed on the test PC). Manual steps in docs/TESTING.md (1d).

🤖 Generated with Claude Code

[pullfrog]

Important

The installer timeout can leave a setup process running after the UI reports failure, allowing a later attempt to launch another installer.

Reviewed changes This review covers the ControlFS installation flow, release selection and verification, session-menu progress behavior, and associated tests and documentation.

• On-demand installation — The session-menu row downloads and verifies the latest eligible ControlFS setup, runs it silently, and opens ControlFS after installation when the menu is still open.
• Release selection and feedback — The release picker rejects untrusted URLs or missing/invalid digests; localized strings, progress display, failure fallback, and manual checks were added.
• Coverage and metadata — Added picker tests and updated changelogs and version metadata.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6-luna ｜ 𝕏}

[pullfrog]

Important

The timeout fix still does not guarantee that the installer process tree has exited before another attempt is allowed.

Reviewed changes This review covers the timeout handling added since the prior Pullfrog review.

• Terminated timed-out setup — The installer now attempts to kill its process tree on cancellation, waits for the setup process, and reports a timeout.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6-luna ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes This review covers the retry guard added since the previous Pullfrog review.

• Blocked overlapping installs — Added a process-name check before starting another install so an active ControlFS setup, including Inno's extracted child, prevents a retry.

  ^{｜ View workflow run ｜ Using gpt-6-luna ｜ 𝕏}