fix(desk): the heid bug-hunt panel on the row controls (round "Slate", 4/4)

- Touch: on a coarse pointer every row control is at least 28px square
  again (32px), and wipe stands clear of the zip link. The move onto the
  facts line had dropped the deliberate 28px floor to ~21px, 4-6px from
  zip; with scripts off no confirm fires, so a mis-tap on wipe is the
  delete. The zip link no longer breaks between its glyph and its word,
  and each separator is glued to the item after it.
- The wipe dialog shows the name as it should be read: control and bidi
  formatting characters in an agent-made name show as U+FFFD, so U+202E
  or a newline cannot rewrite what the operator approves. An unknown
  data-confirm word now prompts generically instead of submitting
  unguarded (fail closed).
- No page scrolls sideways: `code` wraps anywhere, so a long unbreakable
  install path in the footer or the empty Desk no longer widens every
  page. The overflow test now sweeps 390/720/850/1000/1400 with the
  heaviest row the Desk draws, and compares scrollWidth with the page's
  own clientWidth.

Its first fixture used a hyphenated path, which wrapped by itself; the
test passed with the bug present until the path became one unbreakable
run. r2_flow.toml: 27/27 proved. 749 passed.

docs/contracts/r2_flow.contract.md

@@ -337,6 +337,18 @@ no hover. The side column renders only when the row has a badge, so a row
 without one reserves nothing. The forms, POST targets and `data-confirm`
 wording are unchanged.
 
+- **On a coarse pointer every row control is at least 28px square**, the floor
+  it had as a column, and wipe stands clear of the zip link. With scripts off
+  no confirm fires, so a mis-tap on wipe is the delete. A fine pointer keeps
+  the compact line.
+- **The confirm dialog shows the name as it should be READ.** Control and bidi
+  formatting characters in an agent-made name show as U+FFFD, so a U+202E or a
+  newline cannot rewrite what the operator approves. A `data-confirm` word the
+  page does not know still asks, generically: the prompt fails closed.
+- **No page scrolls sideways at any width**, including an install path with no
+  break opportunity in the footer or the empty Desk (`code` wraps anywhere).
+  Tested at 390, 720, 850, 1000 and 1400px with the heaviest row the Desk draws.
+
 ### C5 — the lightbox (booth.html, booth_view)
 
 - **Layout.** Two panes on a gallery booth: the set on the left, the