fix: release-review findings (stats export queue, JSON Feed leniency, change notes)

[WPTK]

Fixes four findings from the beta.8 release-gate review.

Root causes and changes

1. Stats export (fix(api): downloads are plain reads, with no origin rule #354): a second concurrent export answered 429 JSON, but the page starts exports with <a download>, and a browser saves whatever a download link answers, so the error became the file. Root cause: refusing a request the client cannot handle. Two designs: (a) refuse in the server and prevent a second start in the UI plus make errors not look like files (cannot cover a second tab, a bookmark or another page); (b) the server queues the second request behind the first. Chose (b): the slot is now a one-slot channel, the second request waits and then runs, and it is dropped only when its client goes away. No refusal path remains. The test sends a plain cookie-only GET while one export runs and asserts it waits, then returns the attachment, and that a departed client gets nothing.
2. JSON Feed version check ran on every fetch, so a subscribed feed with "version":"1" or "1.0" would start failing. Strictness is now ParseOptions.Strict, set only by discovery (adding an address); fetching accepts any JSON object with an items array. Both paths tested.
3. changes/downloads-origin.fixed.md no longer claims reloads or bookmarks for backups (single-use token).
4. changes/tap-targets-layout-text.fixed.md now notes the Gazette description wording.

Removes the 429 busy path and the atomic flag; adds a channel slot, one option and tests. docs/design.md updated (Downloads, parse rules).

Checks: gofmt, go vet, go test internal/api internal/fetch internal/discover, changelog check.

🤖 Generated with Claude Code