[pending-judge] fix(DC-161 r3): address judge r2 blockers

All three r2 blocking issues fixed + polish applied:

- useExisting (adopted) Radicale containers no longer get a source registered
  with credentials the operator never provisioned. Registration happens ONLY
  when pre-start provisioning succeeded; adopted deployments get a
  calendarHint in the deploy response pointing at the manual-wiring modal.
- Weekly BYDAY expansion: candidates earlier than DTSTART are skipped (they
  do not consume COUNT); window inclusion now uses interval-overlap
  semantics (occurrence span vs window span) for both recurring and
  non-recurring events. Three new tests cover midweek DTSTART, a straddling
  multi-day event, and a boundary-exactly-ending event.
- Verifier is now read-only on the graded tree: no stash/checkout/rewrite.
  Base proof runs in a temporary git worktree of 448f535 under /tmp (removed
  on exit); the flaky pdf-parse suite is proven pre-existing via "red at
  base" + "patch touches no billing file" (empty diff), and a race-flaky
  suite (DC-116, witnessed once under parallel load) is given one isolated
  rerun which must pass.

Polish: PUT /sources normalizes the user field (and clamps name) like POST.

Calendar suites: 38 passed (35 + 3 new recurrence tests). The 3558/3564
full-suite numbers vary by one flaky pdf-parse member between runs; the
evidence now asserts the invariant (suite red at base, no billing file in
the patch, flaky suites green on isolated rerun) instead of an exact count.

dashcaddy-api/src/calendar/ics-parser.js

@@ -130,8 +130,14 @@ function notExcluded(ev, date) {
 
 /** Build an occurrence in the output list if it overlaps the window. */
 function pushOccurrence(ev, occ, duration, rangeStart, rangeEnd, out) {
-  if (occ >= rangeStart && occ <= rangeEnd && notExcluded(ev, occ)) {
-    out.push({ ...ev, start: new Date(occ), end: duration ? new Date(occ.getTime() + duration) : null, recurring: true });
+  // Overlap semantics (judge r2 fix): an occurrence counts when its span
+  // [occ, occ+duration) intersects [rangeStart, rangeEnd) — not just when
+  // its start point is inside. Multi-day events that straddle a boundary
+  // are therefore included/excluded correctly.
+  const occEnd = duration ? new Date(occ.getTime() + duration) : null;
+  const overlaps = occ < rangeEnd && (occEnd ? occEnd > rangeStart : occ >= rangeStart);
+  if (overlaps && notExcluded(ev, occ)) {
+    out.push({ ...ev, start: new Date(occ), end: occEnd, recurring: true });
   }
 }
 
@@ -166,6 +172,10 @@ function emitWeekByday(ev, cursor, byday, ctx, out) {
     const occ = new Date(weekStart);
     occ.setDate(occ.getDate() + dayCodes[bd.day]);
     occ.setHours(cursor.getHours(), cursor.getMinutes(), cursor.getSeconds(), 0);
+    // RFC 5545: the first instance IS DTSTART. Candidates earlier than the
+    // start-of-week-dtstart do not consume COUNT and are not emitted
+    // (judge r2 fix: the partial week before DTSTART must stay empty).
+    if (occ < cursor) continue;
     if (emitted >= count - ctx.emitted) break;
     if (until && occ > until) break;
     // Occurrences generated by the rule consume COUNT even when EXDATE removes them.
@@ -232,7 +242,13 @@ function materializeEvent(ev, rangeStart, rangeEnd, events, errors) {
   }
   if (ev.rrule) {
     expandRecurrence(ev, rangeStart, rangeEnd, events);
-  } else if (ev.start <= rangeEnd && (ev.end || ev.start) >= rangeStart) {
+    return;
+  }
+  // Same overlap semantics as pushOccurrence: half-open [start, end) vs window.
+  const occEnd = ev.end
+    ? new Date(ev.end)
+    : new Date(ev.start.getTime() + (ev.allDay ? 86400000 : 60000)); // default span: all-day=1d, timed=1m
+  if (ev.start < rangeEnd && occEnd > rangeStart) {
     events.push({ ...ev, recurring: false });
   }
 }