Fix bugs and harden codebase: navigation sync, InfoBar state, CTS leak, XML injection, Dispose pattern

[Copilot]

Full codebase audit fixing correctness bugs, a resource leak, a security issue, and Dispose pattern violations.

PR #4 review fixes

• AppSettings.UpdateMode default 2→0: Prevented silent auto-update+restart without user consent
• IsVelopackInstalled: Property→method to avoid UpdateManager instantiation on every access
• Deduplicate ResolveAndPersistRecommendedChannel: Single call site in App.OnLaunched; UpdateViewModel reads persisted setting directly
• UpdateViewModel cache hygiene: Clear _cachedUpdate on failure; reuse UpdateService via _lastCheckedPrerelease tracking
• CI restore/build parity: Add -p:WindowsPackageType=None to dotnet restore to match dotnet build --no-restore

Codebase-wide audit fixes

• MainWindow.NavigateTo ignores FooterMenuItems: Settings (in footer) never got nav selection synced. Fix: MenuItems.Concat(FooterMenuItems)
• MainWindow.ShowInfo leaks ActionButton: After ShowInfoWithAction, subsequent ShowInfo calls left the old button visible. Fix: GlobalInfoBar.ActionButton = null
• AppSettings.DebounceSave CTS leak + race: Old CancellationTokenSource was canceled but never disposed; concurrent Set<T> calls raced on _saveCts. Fix: Interlocked.Exchange + Dispose
• AutoStartHelper.CreateTask XML injection: Username/path interpolated raw into XML template. Fix: SecurityElement.Escape() on all dynamic values

var escapedUserId = SecurityElement.Escape($@"{Environment.UserDomainName}\{Environment.UserName}");
var escapedExePath = SecurityElement.Escape(exePath);

• DashboardViewModel.Dispose: Missing GC.SuppressFinalize(this)

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.