fix(desktop): recover corrupt connection catalogs

[wizzoapp]

What Changed

• Quarantine malformed desktop connection-catalog outer documents under a unique .corrupt-<timestamp> recovery name, then attempt legacy migration or start empty.
• Serialize catalog reads, recovery, writes, and clears so a concurrent repair cannot be quarantined.
• Fsync temporary catalog writes before atomic replacement.
• Preserve recognizable future-version catalogs and keep safeStorage, base64, and DPAPI/decryption failures distinct and non-destructive.

Why

confirmed root cause from owner live diagnosis; supersedes the stale-thread theory

The Windows-side connection-catalog.json was exactly 912 all-NUL bytes. Desktop threw during outer-document decoding before renderer connection initialization or WSL auth began, while the web path already recovered from malformed catalog storage.

Verification

• RED on main-derived code: all-NUL and truncated JSON cases both threw DesktopConnectionCatalogStoreDocumentDecodeError (2 failures; 8 existing tests passed).
• GREEN: 27 focused desktop catalog, web catalog-storage, and Fix desktop session restore resilience #227 session-restore tests.
• Desktop typecheck, focused lint, formatting, and diff checks pass.
• Factory pre-commit gate passes after class-wide fixes for recovery/write serialization and future-version preservation.
• Explicit Codex gpt-5.5 branch review: no accepted/actionable findings.

UI Changes

None.

Checklist

• This PR is small and focused
• I explained what changed and why
• UI screenshots are not applicable
• Animation/video is not applicable

[adamfgr]

Auto-approved by wizzo-approve: all policy conditions verified against HEAD 6146a3b.