iris android app: told which server by an enrol link, not by its build

The APK is cross-compiled here and run against the server on the host, so
everything build.rs baked in (AI_APP_TRANSCRIPT_HOST/_PORT/_TOKEN and this
machine's CA) was good for exactly the pair that built it -- and a token in
a delivered artifact besides. MainActivity registers aiapp://enroll, hands
the URI and the app's private files directory to Rust, and
client_core::config stores it 0600; transcript_client reads it afresh per
transport, so opening a new link repoints a running app.

Diagnostics says which of three things is true, because they want different
actions: 'enrolled: host:port', 'not enrolled -- open the enrol link from
Dev Updater', and 'enrolment unreadable: ...' for the case nothing could be
found out. The last is why status() has an Unknown arm at all.

ui-sandbox.sh's printed enrol command now carries the CA, which is what
makes it work for an app with no baked copy.

Verified on this checkout's emulator: fresh install reads 'not enrolled',
the intent enrols (log: 'enrolled with 10.0.2.2:8519', enrollment.json
-rw-------), Diagnostics then reads 'enrolled: 10.0.2.2:8519', and the CA
reconstructed from that link is byte-identical to the machine's ca.pem and
validates the server over curl. Android offered the chooser between this
app and the Compose one, which is the intended behaviour.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

app/ui-sandbox.sh

@@ -404,12 +404,27 @@ done
 # Percent-encoded because the app URL-decodes the deep link's query: a
 # token with '+' in it enrols as one with a space, and nothing reports it.
 enc=$(python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$TOKEN")
+# The CA rides in the link (`wg_app_link::enroll::ca_param`: base64url of
+# the DER, which needs no percent-encoding). The Compose app ignores it and
+# pins the copy its APK was built with; the iris app has no baked copy at
+# all -- it is cross-compiled and could be pointed at any machine -- so
+# without this it enrols and then trusts nothing. Minted here rather than by
+# `--enroll-link` because this token is the sandbox's own, carried across
+# restarts so the emulator stays enrolled (see the top of this file).
+ca=$(python3 - "$CERTS/ca.pem" <<'CA'
+import base64, sys
+pem = open(sys.argv[1]).read()
+body = pem.split("-----BEGIN CERTIFICATE-----")[1].split("-----END CERTIFICATE-----")[0]
+der = base64.b64decode("".join(body.split()))
+print(base64.urlsafe_b64encode(der).decode().rstrip("="))
+CA
+)
 cat <<INFO
 sandbox: server $pid on 127.0.0.1:$PORT, log $LOG
 sandbox: 9 invented Claude Code sessions under $PROJECTS (one of them ${BIG_MB}MB)
 
   enrol the emulator (once; it survives sandbox restarts):
-    adb shell "am start -a android.intent.action.VIEW -d 'aiapp://enroll?host=10.0.2.2&port=$PORT&token=$enc'"
+    adb shell "am start -a android.intent.action.VIEW -d 'aiapp://enroll?host=10.0.2.2&port=$PORT&token=$enc&ca=$ca'"
 
   drive it:
     ./ui-sandbox.sh spawn [title]        an echo session; prints its id