feat(ui): add global exception backstop

[mrcsin]

Problem

Nothing sat under the running dispatcher. Program.Main has a top-level try/catch, but it
only wraps startup — once the Avalonia dispatcher is pumping, three failure classes had no
handler at all: an unsubscribed ThrownExceptions, an unobserved fire-and-forget task fault,
and a background-thread throw. The first crashed or vanished silently; the last died with no
stack in the log, leaving a field-reported background crash undiagnosable.

What changed

Add GlobalExceptionBackstop, installed once at ReactiveUI build time (before the first
ReactiveCommand is constructed), wiring three last-resort handlers:

• Recoverable ReactiveUI handler (via IReactiveUIBuilder.WithExceptionHandler): logs the
  exception and reports a generic message to the panel, keeping the app alive. In DEBUG with a
  debugger attached it breaks. The observer body is wrapped so the terminal handler can never itself
  crash the app.
• TaskScheduler.UnobservedTaskException: logs Error and marks the fault observed.
• AppDomain.CurrentDomain.UnhandledException: logs at Critical (Serilog Fatal) — including a
  non-Exception thrown object — and flushes Serilog before the process dies, so a background-thread
  crash leaves a stack behind.

The panel is resolved lazily at fire time so installing the handler doesn't construct a command
before it's set. This is the last-resort ring only — it doesn't change the happy path and doesn't
replace the per-command report+log ring from PR-F1.

This is PR-F2 of the error/logging pipe roadmap. Follow-on: #113 (F3) rebased on F1+F2.

Note on ReactiveUI: the pipe roadmap was written against RxApp.DefaultExceptionHandler, but
this project's ReactiveUI (23.2.28) removed RxApp; the handler is set via the one-shot
WithExceptionHandler at UseReactiveUI build time. Build-time registration is what guarantees the
"before first command construction" ordering.

Verification

• dotnet build SemiStep.slnx — 0 warnings (warnings are errors).
• dotnet test SemiStep/SemiStep.Tests/SemiStep.Tests.csproj — 1478 passed, 0 failed (+4 new tests).
• dotnet format clean; Rider analyzer clean on the changed files.
• Automated covers the handler logic (report+log / log-only / log-critical, exception identity) and the recoverable observer→panel wiring.
• Manual smoke (an unhandled command fault keeps the app alive + logs; a fire-and-forget fault logs; a background-thread throw flushes a fatal stack; install precedes command construction) was run — these OS-hook / one-shot-API paths cannot be fired deterministically in-process.
• Ran through the full multi-agent review chain (comprehensive, smells, comment audit, critical); the ReactiveUI-API deviation was caught and adapted mid-flow, and the observer was hardened (guarded Debugger.Break, never-throw body, non-Exception fatal logging).

Per-task commits before collapse

9d532fd feat(ui): add global exception backstop handler logic
06d5203 feat(ui): install global exception backstop hooks
99898f6 feat(ui): install exception backstop at ReactiveUI build time in App.Run
f6ab971 docs(architecture): document the global exception backstop ring
bc37741 fix(ui): harden backstop observer and reconcile F2 plan doc
2406df4 docs(plans): reconcile F2 plan with dropped _installed flag
101732d refactor(ui): qualify Serilog flush and log non-exception fatals
ee4bd87 docs(plans): record exec branch + verification steps for PR-F2