One door per name on the IPC bus

A second IpcHandler with an already-used target does not error -- it
silently shadows the first, and for the polkit target that means the
agent's authentication requests stop reaching the prompt: every
password dialog on the desktop, gone without a message. That duplicate
nearly shipped once, because the handlers live scattered through a
long shell.qml. The contract pairs every IpcHandler with its quoted
target across the shell's QML (harnesses excluded -- each is its own
root), fails on any name declared twice, and refuses to pass on an
empty scan so a declaration-format change cannot quietly blind it.

README.md

@@ -113,7 +113,7 @@ docs/           Settings reference, and the design specs behind the work
 
 ## Tests
 
-134 of them, under `tests/`. Run the lot, or a subset by pattern:
+135 of them, under `tests/`. Run the lot, or a subset by pattern:
 
 ```sh
 panama test           # everything