Authenticate Android snapshot helper sessions and bound silent peers #4519

Umbrella #4368. Source confirmed on main ddbfc85; no native proof yet. The user authorized Claude completion workers and independent assumption/correctness verification.

Trigger: SnapshotInstrumentation.java accepts loopback TCP connections and reads each line serially without credentials, a read deadline or a line limit. Input/screenshot/tree/app/gesture and quit dispatch are reachable. One silent peer can block a reused session request and reach the permanent persistent-session-disable branch. This latter consequence is source-derived, not runtime-proven.

Required invariant: Untrusted co-installed apps cannot dispatch helper commands or occupy the command reader indefinitely. Authentication precedes any read/action, including quit. Bound accepted request lifetime and resource use while preserving serialized execution, typed dispatch disclosure, cancellation and session cleanup. Treat the existing adb operator trust boundary explicitly; do not claim uid authentication identifies the original host user of a forwarded socket.

Design-first gate: Verify a device abstract UNIX socket and kernel peer uid through adb forwarding on one owned supported Android device. Accepting shell/root peers is a candidate design only. Verify both forwarded authorized peer and an untrusted app-uid negative plus SELinux behavior. If unavailable or failing, stop and record the gap; do not silently implement token fallback. A helper-generated token is a separate possible policy, not adopted. Never put a credential in am instrument argv.

Before code, record justified read/line/resource bounds, running-helper capability/skew handling and older provider-helper behavior. The suggested4MiB cap has unverified Binder reasoning and is not adopted; current fill has no such public limit. Bundled helper versionCode is derived from npm version; do not manually bump it. The existing Java SnapshotHelperTestSuite is the test owner.

Completion: finite policy Decision, independently reviewed source, real command-route/protocol regression and meaningful mutant/base detection, exact-head affected validation with #4050 fallback, and owned-device evidence for unauthorized/partial/silent peers and normal snapshot/input/quit. Use T3 device tools and the returned CLI for app/device actions; builds/install/logs/project test runners remain permitted exceptions. No new generic server framework, retries to fish for pass, test weakening, merge/release/tags or unrelated PR work.