[pending-judge] fix(DC-161 r3): address judge r2 blockers

All three r2 blocking issues fixed + polish applied:

- useExisting (adopted) Radicale containers no longer get a source registered
  with credentials the operator never provisioned. Registration happens ONLY
  when pre-start provisioning succeeded; adopted deployments get a
  calendarHint in the deploy response pointing at the manual-wiring modal.
- Weekly BYDAY expansion: candidates earlier than DTSTART are skipped (they
  do not consume COUNT); window inclusion now uses interval-overlap
  semantics (occurrence span vs window span) for both recurring and
  non-recurring events. Three new tests cover midweek DTSTART, a straddling
  multi-day event, and a boundary-exactly-ending event.
- Verifier is now read-only on the graded tree: no stash/checkout/rewrite.
  Base proof runs in a temporary git worktree of 448f535 under /tmp (removed
  on exit); the flaky pdf-parse suite is proven pre-existing via "red at
  base" + "patch touches no billing file" (empty diff), and a race-flaky
  suite (DC-116, witnessed once under parallel load) is given one isolated
  rerun which must pass.

Polish: PUT /sources normalizes the user field (and clamps name) like POST.

Calendar suites: 38 passed (35 + 3 new recurrence tests). The 3558/3564
full-suite numbers vary by one flaky pdf-parse member between runs; the
evidence now asserts the invariant (suite red at base, no billing file in
the patch, flaky suites green on isolated rerun) instead of an exact count.

dashcaddy-api/__tests__/unit/ics-parser.unit.test.js

@@ -72,6 +72,32 @@ describe('DC-161 ics-parser', () => {
     expect(events).toHaveLength(4);
   });
 
+  test('weekly BYDAY does not emit candidates before DTSTART (midweek start)', () => {
+    // 2026-10-07 is a Wednesday; a MO,WE,FR rule must NOT emit Monday Oct 5.
+    const { events } = parseIcs(ics(
+      'BEGIN:VEVENT\r\nUID:10\r\nDTSTART:20261007T100000Z\r\nDTEND:20261007T110000Z\r\nRRULE:FREQ=WEEKLY;BYDAY=MO,WE,FR;COUNT=3\r\nSUMMARY:Midweek start\r\nEND:VEVENT'
+    ), RANGE);
+    expect(events.map(e => e.start.toISOString().slice(0, 10))).toEqual([
+      '2026-10-07', '2026-10-09', '2026-10-12',
+    ]);
+  });
+
+  test('multi-day event straddling the window start is included (overlap semantics)', () => {
+    // Event runs Sep 28 → Oct 2; window starts Oct 1.
+    const { events } = parseIcs(ics(
+      'BEGIN:VEVENT\r\nUID:11\r\nDTSTART:20260928T000000Z\r\nDTEND:20261002T000000Z\r\nSUMMARY:Straddling retreat\r\nEND:VEVENT'
+    ), RANGE);
+    expect(events).toHaveLength(1);
+  });
+
+  test('multi-day event ending exactly at window start is excluded', () => {
+    // Event runs Sep 25 → Oct 1 00:00; window starts Oct 1 00:00 — zero overlap.
+    const { events } = parseIcs(ics(
+      'BEGIN:VEVENT\r\nUID:12\r\nDTSTART:20260925T000000Z\r\nDTEND:20261001T000000Z\r\nSUMMARY:Ends at boundary\r\nEND:VEVENT'
+    ), RANGE);
+    expect(events).toHaveLength(0);
+  });
+
   test('events outside window are excluded; window straddles inclusion', () => {
     const { events } = parseIcs(ics(
       'BEGIN:VEVENT\r\nUID:7\r\nDTSTART:20260901T090000Z\r\nDTEND:20260901T100000Z\r\nSUMMARY:September only\r\nEND:VEVENT'