fix(client,sdk): the smaller silent failures, and a dead SDK test file

The SDK's parity suite had an unescaped apostrophe in an it() title, so the
file did not parse and vitest reported it as "no tests". Both guards in it
were dead - including the byte-identical egress-policy check the package's own
notes call the worst possible bug in that module to lose. No CI job runs the
SDK suite, so it landed quietly; the next npm publish would have failed on it,
since prepublishOnly runs the tests.

Also in the SDK: the dev preview answered trek:geolocation without checking
the geolocation:read grant, so a plugin whose manifest is missing the
permission works perfectly in dev and is dead once installed. That is the
lenient direction, which is the one that ships broken plugins.

Client side: the background-task poll never dismissed a 404'd import job and
spun forever, "Update All" collapsed its busy flag after the first plugin
settled, the lightbox had no cancellation so a slow signed URL rendered the
wrong image, the plugin geolocation watch was torn down by any unrelated
settings write, manual date entry accepted 31 February, cover previews were
never revoked, and check-all issued one request per packing item.

client/src/components/SystemNotices/SystemNoticeModal.test.tsx

@@ -298,6 +298,18 @@ describe('ModalRenderer', () => {
     expect(screen.getByText('Hello Alice, welcome to TREK')).toBeTruthy();
   });
 
+  it('FE-SN-MODAL-057: a body param is inserted literally, not as a replacement pattern', async () => {
+    const notice = makeNotice({
+      bodyKey: 'Version {version} is here',
+      bodyParams: { version: '4.0.0 ($&)' },
+    });
+    render(<ModalRenderer notices={[notice]} />);
+
+    await flushGraceDelay();
+
+    expect(screen.getByText('Version 4.0.0 ($&) is here')).toBeTruthy();
+  });
+
   it('FE-SN-MODAL-008: empty notices renders nothing', () => {
     const { container } = render(<ModalRenderer notices={[]} />);
     expect(container.firstChild).toBeNull();

client/src/components/SystemNotices/SystemNoticeModal.tsx

@@ -617,13 +617,17 @@ function useSystemNoticeModal(notices: SystemNoticeDTO[]) {
 
 type NoticeState = ReturnType<typeof useSystemNoticeModal>;
 
+const escapeRe = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
 // Build the NoticeContent props for a given notice + pager slot index.
 function makeContentProps(S: NoticeState, n: SystemNoticeDTO, slotIdx: number): ContentProps {
   const { t, isDark, canPage, notices, handleDismissAll, handleCTA, handleSecondaryCTA, handlePrev, handleNext, handleGoto } = S;
   const rawBody = t(n.bodyKey);
+  // The key is escaped into the pattern and the value goes in through a function, so a
+  // value carrying $&, $1 or $` is inserted as typed instead of being expanded.
   const body = n.bodyParams
     ? Object.entries(n.bodyParams).reduce(
-        (s, [k, v]) => s.replace(new RegExp(`\\{${k}\\}`, 'g'), v),
+        (s, [k, v]) => s.replace(new RegExp(`\\{${escapeRe(k)}\\}`, 'g'), () => v),
         rawBody
       )
     : rawBody;