fix: an open popup moves to the recovery screen when its profile becomes unreadable (closes #373)

A popup already open when the stored profile became unreadable stayed on the
last good profile until reopened. Every save already runs the check loadState()
runs at open; a save refused by it now stops the ten-second refresh, runs the
leave cleanup of the current screen, and raises the recovery screen. From then
on showView() shows nothing else in that popup, so a transaction wait or a later
save cannot take the user off it or clear an export or a typed confirmation.
That is held in memory, never as the saved current view, so a popup opened
after the record is erased elsewhere opens normally. Any other failed save
keeps the "NOT SAVED" banner. The popup test harness now honours
clearInterval().

Model: opus-5-5

README.md

@@ -2032,8 +2032,8 @@ view would leave a wallet one click from deletion.
   is no profile to check one against.
 - Not in `RESTORABLE_VIEWS`, and never recorded as the current view: the record
   can become readable again under an open popup, erased in another window, and
-  the next save from that popup then succeeds. A popup opened after that opens
+  the next save from that popup then succeeds. A popup opened after that shows
-  normally.
+  **Welcome** or **Home** as usual.
 
 ### External Services