feat(android): add optional private comparison for secure input

[AdzeB]

Add optional native private input comparison for secure fields

Android secure fields can expose masked accessibility text even after a successful
fill. Preserving password, hint, selection and mask metadata improves evidence,
but metadata alone cannot prove the exact value was entered. The existing Android
IME helper commits and clears input; it does not currently provide private
readback/comparison evidence.

Reproduction and bounded evidence

A disposable API 36 emulator ran a native synthetic EditText fixture and a
diagnostic IME in separate application processes. After public agent-device fill
with synthetic 2468, the secure node reported password:true and accessibility
mask_only text of length 4. The IME's InputConnection extracted text reported
length 4 and equality true against that fixed synthetic expectation. Filling a
different same-length synthetic value, 1357, produced length 4 and equality false.
The observed extraction had startOffset 0 and partialStartOffset/partialEndOffset
-1. Retrieved text was compared in-process and never printed.

This establishes a narrow native feasibility result on that fixture and device.
It does not establish support for every app, WebView, custom editor, Android
version, or another platform.

The fixture uses EditText with TYPE_CLASS_NUMBER | TYPE_NUMBER_VARIATION_PASSWORD
and PasswordTransformationMethod.getInstance(). The separate diagnostic IME
calls getCurrentInputConnection().getExtractedText(request, 0) and compares
extracted.text to the fixed synthetic expectation in-process. This is a probe,
not the proposed production protocol: fragment equality alone cannot establish
complete, target-bound field equality.

Proposed capability

Add an optional private comparison operation through the existing Android IME
helper, returning a structured match, mismatch, or unknown result. Keep raw
field text inside the native helper. This should supplement fill evidence without
making accessibility masks an exact-value assertion.

The operation should require:

• A stable target binding: device/session, app package, editor field identity,
  focused target, and input-connection generation. Bind the expectation and reply
  to a fresh nonce; reject focus or generation changes during capture/comparison.
• Fresh, complete value evidence after the action. Check extraction offsets and
  partial-update markers, and prove completeness within bounded reads. A cursor
  fragment, stale extraction, truncation, or unavailable completeness signal must
  yield unknown, even if a returned fragment matches.
• Bounded read sizes, request duration, and retries. Unsupported/refused/null
  connections, unsupported editors, timeouts, and uncertain ownership return
  explicit unknown/unsupported reasons rather than success or empty-value claims.
• Explicit opt-in capability and permission gates for the helper/IME, with target
  ownership checks. Preserve existing guards against typing into the IME itself.
  Restore prior IME configuration when a session ends or fails.
• Secret privacy throughout transport, logs, errors, traces, and artifacts. Do not
  serialize raw retrieved values or expected secrets into evidence. Return only
  the comparison result and minimal non-sensitive provenance needed to validate
  freshness; do not expose lengths by default unless separately justified.

Expose this as a platform capability through the shared tool contract: callers
must be able to discover support and handle unknown consistently on Android, iOS,
and web. Do not imply an Android IME implementation automatically supplies iOS or
web parity. Unsupported platforms should retain truthful evidence limitations.

Acceptance checks

• Correct and wrong same-length synthetic inputs yield distinct comparison
  outcomes on a genuinely masked native field.
• Empty values, selection/cursor movement, focus switches, editor recreation,
  stale sessions, partial extraction, truncation, and refusal cannot produce a
  false match.
• The helper remains a separate process and preserves existing input-owner gates.
• Automated log/trace/error inspection finds neither expected nor observed secret
  values, including failure paths.
• Unsupported editor/platform paths return unknown and cannot upgrade a
  checkpoint to exact-value success.

This issue proposes a capability boundary and validation work, not a production
ready implementation or universal support claim. A metadata-only change remains
useful independently but does not close the exact-comparison gap.

[thymikee]

Triage: the feasibility evidence is useful and the privacy/freshness constraints are directionally sound, but this is deliberately not implementation-ready. It first needs a maintainer decision on whether agent-device should expose a cross-platform secure-value comparison capability and, if accepted, an owning shared contract plus threat-model review. Marking needs-triage rather than ready-for-agent; no reporter information is currently missing.