feat(runtime): add contained transports for managed leases

[thymikee]

Summary

• Add request-local Android ADB provider and host transport support for managed lease private server ports.
• Add the exact managed lease environment reachability adapter for the iOS simulator set and Android ADB port.
• Add adversarial and fake-ADB tests proving transport isolation without mutating process environment.

This PR is the contained-transport foundation only. It deliberately does not register managed owners, acquire allocator claims, or wire a Host/Simlock granted lease into the exact request binding. The current managed-owner boundary fails closed until that Host integration exists, as required by ADR 0021.

Validation

• pnpm check:affected --run passed on the exact head.
• Focused managed reachability and Android transport suite: 45 tests passed.
• Android package suite: 626 tests passed.
• Apple simulator and inventory suite: 61 tests passed.
• Apple XCTest suite: 103 tests passed.
• Planted-red proof: reverting the Android transport implementation made 8 new tests fail.
• Live Simlock-managed device evidence was unavailable locally: no active managed lease or private endpoint existed, and no device was mutated.

Follow-up

Host/Simlock integration must pass the granted lease into the exact managed runtime binding, wrap the admitted command in reachability.run, and add routed Android inventory/operation plus iOS simulator-set proof. This PR does not claim that production managed commands are wired yet.

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	2.61 MB	2.61 MB	+1.6 kB
JS gzip	878.4 kB	879.0 kB	+586 B
npm bundled raw	2.61 MB	2.61 MB	+1.6 kB
npm bundled gzip	878.4 kB	879.0 kB	+586 B
npm tarball	1.04 MB	1.04 MB	+506 B
npm unpacked	3.52 MB	3.52 MB	+1.6 kB
npm clean-installed	3.52 MB	3.52 MB	+1.6 kB

npm unpacked components

Component	Base	Current	Diff
JS / dist source	2.77 MB	2.77 MB	+1.6 kB
Apple runner source/project	544.4 kB	544.4 kB	0 B
Apple snapshot presentation source	33.8 kB	33.8 kB	0 B
Apple Simulator snapshot bridge source	30.5 kB	30.5 kB	0 B
macOS helper source	54.8 kB	54.8 kB	0 B
Android helper artifacts	43.3 kB	43.3 kB	0 B
Other package files	46.7 kB	46.7 kB	0 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	23.9 ms	24.3 ms	+0.4 ms
CLI --help	61.0 ms	61.7 ms	+0.7 ms

Top changed chunks: no changes in the largest emitted chunks.

Top changed packed files

Packed file	Base	Current	Diff
dist/src/adb-executor.js	4.7 kB	5.8 kB	+1.0 kB
dist/src/platform-runtime-android-adb-host.js	2.5 kB	3.1 kB	+524 B
dist/src/device-input-state.d.ts	8.7 kB	8.7 kB	+23 B

[thymikee]

Review at exact head f9ee5d9 is blocked. P1: createManagedLeaseReachability is only referenced by its new test; no granted lease, managed runtime binding, or request route imports it. Therefore neither the iOS simulator-set path nor Android private-ADB-port scope can affect a real managed command, and the fake-ADB tests remain green even if production can never reach the adapter. Wire it at the single granted-lease → exact managed runtime-binding boundary and add a routed regression from a granted lease through a representative Android operation/inventory proving the private port (and iOS simulator-set path), or explicitly reframe this as unused foundation rather than a routing feature. The PR has ~321 net production lines and +1.6 kB unpacked, below the escalation thresholds; all completed checks pass, iOS Smoke is still pending, and live managed-lease evidence remains unavailable.

[thymikee]

Addressed the P1 by narrowing this PR scope. The title/body now describe the contained transport foundation, not production managed-command routing. The current tree intentionally has no Host/Simlock grant route or production managed-owner registration; ADR 0021 and the existing exact-owner refusal path make that integration a separate follow-up. The reachability adapter remains the typed seam that follow-up must use at the granted-lease → exact managed binding boundary, with routed Android inventory/operation and iOS simulator-set proof. Current head f9ee5d9 is unchanged and all GitHub checks pass.