Put the log and the crash records in one file, and show it before writing it

NFR-OPS-1 asks for a diagnostics bundle — the log, the schema version, the
GPU and driver, the app version — "with an explicit preview-and-consent
step before anything leaves the device". The log and the crash records
have existed since August; what did not exist was any way to hand them
over that was not `adb pull` and a knowledge of where the state directory
is, which on the tablet the requirement was written for is nobody.

Nothing here sends anything, and that is the design rather than a gap:
crash.rs already says why a transport built ahead of the consent is the
shape of thing that gets switched on by default. The bundle writes one
text file to a place the user can find, so that they can attach it. That
is the moment it leaves, and it is theirs. So the consent guards the
write, not a send. Preparing gathers everything into memory and shows
what would be written — each section, its size, what was taken out, and
where the file would go — and only the second press puts bytes on disk.
A user who reads the preview and presses the other button has changed
nothing anywhere. The gathered bundle is held between the presses so what
is saved is exactly what was shown, not a second gathering that differs
by whatever was logged while they were reading.

One text file rather than an archive, because a `.txt` opens wherever
the user is sitting and pastes into an issue, and because the preview
can then be the file rather than a summary of it. Every line goes
through the blunter of the two redactions on the way in, whatever the
sink already did to it: the log's own rule keeps paths, since a path
read over `adb` is context, but a file meant to be attached to a public
report by someone who may not read it first is held to the crash
record's rule instead.

The About page's graphics line gains the driver, which the requirement
names and the adapter has always reported. And docs/outstanding.md is
corrected on both OPS requirements: it said crash reporting was a
log::error! hook and NFR-OPS-1 had nothing behind it, and neither had
been true since 2026-08-30.

ui/dr-ui/src/lib.rs

@@ -1192,6 +1192,79 @@ pub fn run(paths: Vec<PathBuf>) -> Result<()> {
         None => window.set_backend("NO GPU".into()),
     }
 
+    // TRACES: NFR-OPS-1
+    // The diagnostics bundle, wired as the two presses the requirement
+    // describes. Preparing gathers the log and the crash records into memory
+    // and shows what would be written; saving writes it; discarding drops it
+    // and writes nothing. The gathered bundle is held between the presses so
+    // that what is saved is exactly what was shown — a bundle gathered again
+    // at save time could differ from its own preview by whatever was logged
+    // while the user was reading.
+    {
+        use dr_plat::diagnostics::bundle::{Bundle, Facts};
+        let facts = Facts {
+            app_version: env!("CARGO_PKG_VERSION").to_string(),
+            schema_version: dr_catalog::schema::SCHEMA_VERSION,
+            graphics: match &gpu {
+                Some(ctx) => format!(
+                    "{} ({:?}), {}",
+                    ctx.adapter_name(),
+                    ctx.backend(),
+                    ctx.driver()
+                ),
+                None => "no GPU".to_string(),
+            },
+        };
+        let pending: Rc<RefCell<Option<Bundle>>> = Rc::new(RefCell::new(None));
+        {
+            let weak = window.as_weak();
+            let pending = pending.clone();
+            window.on_diagnostics_prepare(move || {
+                let Some(w) = weak.upgrade() else { return };
+                let bundle = Bundle::gather(&facts);
+                w.set_diagnostics_preview(
+                    bundle
+                        .preview(&dr_plat::diagnostics::bundle::default_dir())
+                        .into(),
+                );
+                w.set_diagnostics_result("".into());
+                *pending.borrow_mut() = Some(bundle);
+            });
+        }
+        {
+            let weak = window.as_weak();
+            let pending = pending.clone();
+            window.on_diagnostics_save(move || {
+                let Some(w) = weak.upgrade() else { return };
+                let Some(bundle) = pending.borrow_mut().take() else {
+                    return;
+                };
+                let dir = dr_plat::diagnostics::bundle::default_dir();
+                let result = match bundle.write_to(&dir) {
+                    Ok(path) => {
+                        log::info!("diagnostics bundle written: {}", path.display());
+                        format!("Saved as {}", path.display())
+                    }
+                    Err(e) => {
+                        log::warn!("diagnostics bundle not written: {e}");
+                        format!("Could not save the bundle to {}: {e}", dir.display())
+                    }
+                };
+                w.set_diagnostics_preview("".into());
+                w.set_diagnostics_result(result.into());
+            });
+        }
+        {
+            let weak = window.as_weak();
+            window.on_diagnostics_discard(move || {
+                let Some(w) = weak.upgrade() else { return };
+                *pending.borrow_mut() = None;
+                w.set_diagnostics_preview("".into());
+                w.set_diagnostics_result("".into());
+            });
+        }
+    }
+
     // Every background job reports here, and this draws the bar across the top
     // of the shell and fills the settings page's list. Built before the
     // controllers because they take a handle to it: a job that starts during