Complete Android hardening and release-readiness parity batch

[mkaltner]

Summary

• completes PAR-401, PAR-402, PAR-403, PAR-404, and PAR-406 with incremental localization, accessibility hardening, deterministic instrumentation coverage, lint/security gates, and explicit alpha/beta policy
• prepares PAR-405 metadata and unsigned build boundaries while accurately leaving F-Droid eligibility blocked by the missing libarcane-kotlin license and proprietary Google Play credentials dependency
• closes PAR-V01, PAR-V02, PAR-V04, PAR-V05, PAR-V06, and PAR-V07 with bounded correctness fixes and current device/live-server evidence
• adds a pinned API 30 CI emulator lane plus a fail-closed disposable live-server harness

Validation

• 380 JVM tests in 66 suites, zero failures/errors/skips
• Android lint: zero new findings; narrow reviewed baseline of 45 pre-existing errors and one hint
• instrumentation: 9/9 on API 24, retained API 30, and API 35
• live Arcane 2.10.2 and isolated 2.11.1 device matrix; current source contract-inspected
• fresh GitHub clone with -Parcane.remoteSdk resolved SDK b29695d547b78389ed7230b35cd133f7046b4b52 and passed unit, debug, and unsigned release assembly
• unsigned release/signing boundary, packaged manifest, permissions, exported components, shortcuts, widgets, backup rules, dependency graph, and repository hygiene inspected
• English, en-XA, and ar-XB at 100%/200% font; compact/expanded/rotation/themes/TalkBack/keyboard representative coverage
• prior-debug upgrade succeeded; platform downgrade protection rejected rollback as expected

Limitations

• no physical-device or recorded spoken-output audit is claimed; both remain beta-promotion evidence
• no successful cloud backup restore was available; strict allowlists and the rejected credential-free transport attempt are recorded
• current Arcane source was inspected but not separately built live
• F-Droid submission, reproducibility, metadata-tool pass, signing, tag, and publication are not claimed or performed
• PAR-502, PAR-503, and PAR-504 remain intentionally deferred

Automated reviews are inactive; the complete diff received independent self-review and authoritative build/device/server validation.