iris is the framework alone; the app is one crate in app-rust/

Iris: "the organization of the rust rewrite is a mess right now... there
shouldn't be anything related to the app inside of iris. Iris is supposed
to be the UI framework alone." And, on the crate count: "I'm confused why
the app only code needs more than one crate though."

Nine cargo workspaces become three, and the port's project code -- which
sat in five places, four of them inside the framework -- becomes one crate,
`ai-app`, in `app-rust/`:

  client-core                -> app-rust/src/client
  iris/transcript-ui         -> app-rust/src/ui
  iris/transcript-fixture    -> app-rust/src/ui/fixture.rs + tests/ + touch/
  iris/desktop-app           -> app-rust/src/desktop + src/bin_desktop.rs
  iris/android-app           -> app-rust/src/android + android-project/
  android-shell              -> app-rust/src/shell

iris/ keeps core, macro, the iris crate, tabs-ui and rig-input, and now
mentions no session, transcript, setup or server anywhere.

Only two of the old splits had a reason that survived reading. event-model
stays a crate at the repo root because server/ depends on it too, so a
crate is what makes the backend and the app agree by construction. The two
Android .so names looked like a hard constraint -- a package produces one
library artifact -- until P2 turned out to already plan merging those two
Android apps into one; both faces now come out of libai_app.so, picked
apart by features so `--no-default-features --features shell` keeps wgpu,
parley and iris out of the Compose app's APK. docs/RUST.md's "One app
crate" has the rest, including what each remaining feature is for.

DECISIONS.md and SUBAGENTS.md move into docs/ with everything else.

Verified: ./run-tests.sh and `cd iris && cargo test` green, clippy and fmt
clean in all five workspaces, `cargo ndk -t x86_64` links libai_app.so,
build-apk.sh produces an APK that installs and launches on this checkout's
emulator (Gl ... virgl, as expected), and the phone-sized headless
screenshot renders the transcript unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/shellApp/build.gradle.kts

@@ -1,11 +1,11 @@
 plugins { alias(libs.plugins.androidApplication) }
 
 // E3 (RUST.md): the Kotlin/Java shell being replaced by a thin JNI bridge
-// into Rust (`../../android-shell`). Deliberately its own module rather
+// into Rust (`../../app-rust`, the `shell` feature). Deliberately its own module rather
 // than a rewrite of `:androidApp` in place -- that module is ~13,000 lines
 // of working Compose UI this experiment does not touch, and the two can be
 // installed side by side on the same development device (see
-// `settings.SCHEME`'s doc in `android-shell` for why the deep-link scheme
+// `settings.SCHEME`'s doc in `app-rust/src/shell` for why the deep-link scheme
 // and Keystore alias are not the production app's). No Compose plugin, no
 // Kotlin source of its own: `MainActivity`/`NotificationService` are plain
 // Java, and the CA constant below is generated as Java too.
@@ -13,7 +13,7 @@ plugins { alias(libs.plugins.androidApplication) }
 // The CA this build pins is baked in the same way `androidApp`'s does --
 // see that module's `build.gradle.kts` comment for the reasoning (the
 // trust boundary follows the machine that builds, never a pasted copy).
-// `PinnedCa.java`'s package must match `android-shell`'s
+// `PinnedCa.java`'s package must match `app-rust/src/shell`'s
 // `settings::load_pinned_ca` lookup (`com/example/aiapp/shell/PinnedCa`).
 val pinnedCaPath: String =
     System.getenv("AI_APP_CA")
@@ -150,12 +150,12 @@ androidComponents {
 
 dependencies {
     // The Keystore-sealed enrollment (ServerStore/ServerSettings) --
-    // android-shell's settings.rs calls into this Kotlin class directly
+    // the shell bridge's settings.rs calls into this Kotlin class directly
     // over JNI rather than re-sealing the token in Rust; see that file's
     // module doc.
     implementation(project(":link"))
     // NotificationCompat/NotificationManagerCompat/NotificationChannelCompat/
-    // ServiceCompat -- android-shell's notify.rs calls these classes over
+    // ServiceCompat -- the shell bridge's notify.rs calls these classes over
     // JNI so the pre-26 fallback behaviour (no channels) lives once, in
     // the library that already has it, rather than being re-derived as a
     // set of Build.VERSION.SDK_INT branches in Rust.