1.26.0: the audit's fixes, and the menu shadow effect withdrawn

A full audit of the tree, and the fixes it produced. docs/AUDIT.md has the third pass in detail: what was run, every bug, and every slow path.

Fixed, worst first

• Explorer acted on the wrong file whenever the Search box was in use. The list showed fewer rows than the entry array held, but Delete, Rename, Open and drop all indexed that array by row. Searching in a folder and pressing Delete offered to bin a different file.
• The logon screen, which runs as root before anyone logs on, opened the wallpaper and picture paths verbatim out of a user-writable file. Any user could have root render another user's or root's own files full-screen. A picture is now loaded only when it is a regular file, inside that user's home, owned by them, and not a symlink.
• Paint corrupted its heap after twelve edits: the undo ring left two slots naming one buffer and then freed it twice.
• The classic Start menu dropped the command you clicked if a Tab or a Ctrl-letter had been pressed first.
• Device Manager kept a device pointer across the rescan that frees them, so opening Properties and plugging in a USB stick read freed memory.
• Also: an unquoted rm -rf built from $HOME, a root-side stack overflow in Disk Management, a use-after-free when a window closes during a taskbar drag, the Windows 7 orb's overhang arithmetic and its dead click at 200%, Aero caption buttons that could never light under the pointer, three modal loops that could be left holding the pointer and keyboard, the tray orphaning its icons, two property leaks per event, silent edit-buffer failures that were written through anyway, a password left behind in freed heap, a search result that could launch a different program, and a dozen more.

Faster and lighter

• The volume level is subscribed to rather than polled: it used to fork a shell and two processes every five seconds for the life of the session.
• Smooth scrolling is driven by the timer instead of sleeping 21 ms inside the button handler.
• The pinned-items file is read when it changes, not on every taskbar repaint.
• Radio buttons, tree connectors and the Start menu's banner are batched instead of costing hundreds of X requests each; icons stop building artwork nothing draws at scales other than 100%; Aero's reflection and caption buttons are worked out once instead of per pixel and per repaint; Show Desktop settles once instead of per window.

Withdrawn

• Show shadows under menus. The effect was broken against every backdrop and worse under a compositor. The option is gone from Performance Options and the code with it; anything already saved for it is ignored.

  curl -sL jacktulli.github.io/w2k | sh