fix(desk): a row's keep, release and wipe take no room of their own

Operator, on the live Desk: "release and x take up space whether or not
they're visible." They sat in a side column at opacity 0, which hides a
control and still reserves its box, and hover-only never worked on
touch.

Each control now sits on the facts line beside the state it changes:
release after "kept", keep after a countdown or hold, wipe last. They
are always visible and quiet, and wipe turns danger only under the
pointer or focus. The side column renders only when the row carries a
badge. The row is flex, so an absent column costs no gap. Forms, POST
targets and data-confirm wording are unchanged.

The flex row exposed a latent sizing bug: the stacked Desk column was a
bare 1fr, whose minimum is its content's, so a long nowrap provenance
line scrolled the page sideways at phone width (1029px at 390). It is
now minmax(0,1fr).

Both behaviours have browser tests, mutation-proved (r2_flow.toml:
21/21). Contract C4 amended.

docs/contracts/r2_flow.contract.md

@@ -328,6 +328,15 @@ The kept/ephemeral lanes are **removed**: 23 of 24 live booths are kept, so the
 lanes sort nothing. Kept status and the lifetime line (`_lifetime.html`,
 unchanged) remain on every row.
 
+**A row's controls sit on its facts line**, each beside the state it changes:
+`release` after "kept", `★ keep` after a countdown or a hold, `× wipe` last.
+They are always visible, with no hover-only reveal: that was a column that
+reserved its room while invisible (operator, 2026-09-23, on the live Desk:
+"release and x take up space whether or not they're visible"), and touch has
+no hover. The side column renders only when the row has a badge, so a row
+without one reserves nothing. The forms, POST targets and `data-confirm`
+wording are unchanged.
+
 ### C5 — the lightbox (booth.html, booth_view)
 
 - **Layout.** Two panes on a gallery booth: the set on the left, the