Place Git tools in context and prepare Azure helper download repair

[danielss-dev]

Git tools were spread across global settings and broad dialogs, while Azure DevOps Server installation requested an unpublished helper channel and returned a generic 404. This change puts tools beside their repository, file, ref, and pull-request context and prepares the compatible helper release with an availability gate for future desktop releases.

• Add repository identity/signing settings, contextual Git/LFS/import/export/bisect/Git-flow actions, a dedicated User actions page, and collapsed advanced options with scrollable dialogs.
• Put review comparison and suggestion previews in Code, paging beside its content, and queue/automatic completion under Merge options. Preserve captured repository/ref targets and keyboard access.
• Prepare strand-azdo 1.3.0 for protocol 7, distinguish missing and incomplete downloads, and require the public manifest, signature, and all platform archives before desktop packaging. Signature and hash enforcement remain unchanged.
• Update the user guide, planning documents, and UI validation record. The two commits separate the helper repair from the UI placement changes.

Validation:

• 469 frontend tests across 85 files passed; TypeScript check and production build passed.
• 19 Rust helper/lifecycle/protocol tests and cargo check for strand-core/strand-tauri passed.
• 9 helper release-script tests and the release security policy passed.
• Built Windows helper reports version 1.3.0 / protocol 7.
• Live availability check passes for protocol 5 and correctly rejects missing protocols 6 and 7; git diff --check passed.

Remaining release/integration work:

• The signed strand-azdo-v1.3.0 release and protocol-7 promotion still need publication before installation can succeed. Already-shipped Strand 1.5.1 also needs a separate protocol-6 backfill.
• Native WebView2 verification of the UI placement revision remains open. Browser verification and its limits are recorded in docs/ui-placement-validation-2026-09-06.md.
• Production build retains the existing large-chunk/mixed-import warnings.