Rename the global stop to Lockdown

[hellno]

Part of #179. Naming/copy only — no wire or semantic change.

Problem / decision

Today's only real "stop" is RevokeAll: zeroize the signing key, deny everything in flight — key, agents, dapps alike. The amber brake presents it as "Stop all agents", which under-describes what it does — and over-promises scope, because no per-agent stop exists (the wire has one anonymous Agent origin).

Decision (2026-07-07): the global action is named Lockdown. "Stop"/"revoke" become the scoped verbs: per-site revoke ships with Connections (#199); a true per-agent stop is a follow-up (needs agent identity on the wire — #204).

Corrected 2026-07-10 (codebase re-verified): the ⌘K command already reads "STOP", not "Stop all agents" — the only runtime string that needs changing is the amber brake label. Scope narrowed below. Do this WITH #199 — its lifecycle copy already references "Lockdown" and both touch the same palette/brake files, so renaming separately re-touches them twice.

Scope (verified)

• The one runtime string to change: the stop_brake Ready label "Stop all agents" → "Lockdown" at widgets.rs:919 (amber = human action). The Armed confirm already reads "Confirm STOP: revoke & lock signing · Esc to cancel" (widgets.rs:921) — decide whether it should also carry "Lockdown".
• The ⌘K command is already fine: title is "STOP — lock & revoke all" (palette_commands.rs:179), aliases stop/panic/kill/revoke/halt/emergency/freeze. Decide whether to add a lockdown alias. (The original body's claim that the command title says "Stop all agents" was wrong.)
• Doc-comments to keep in sync: shell.rs:1478, activity_view.rs:476, and DESIGN.md:167 (prose "Stop all agents").
• Plain-words rule (CLAUDE.md): explain on first use — "Lockdown — stop everything: agents, connected sites, and pending requests; the signing key is wiped from memory until you unlock again." Check "Lockdown" against the plain-words guidance and the amber=human two-signal model.
• Docs: agent quickstart, THREAT-MODEL, README wording.
• Wire/API unchanged: SignerRequest::RevokeAll and the MCP tool id deckard_revoke_all stay; only the tool description gains the Lockdown wording.
• Once Connections: daemon-held dapp sessions, listed in the app, revocable per site #199 lands, Lockdown also clears dapp sessions — the copy should include connected sites.

Taxes

• Touches a GUI view (widgets.rs) → before/after screenshots required on the PR (CLAUDE.md).
• Touches DESIGN.md widget vocabulary → plain-words + two-signal check.

Non-goals

• Per-agent stop (Agent identity on the wire + a true per-agent stop (follow-up) #204).
• Any semantic change to RevokeAll.

Acceptance

Every user-facing surface says Lockdown consistently (⌘K, brake, docs); reflective tests green; screenshots.