dev-updater: build an app on the machine, install it on the phone

A Rust backend that discovers Android projects under configured roots,
builds one on request, and serves the APK over pinned TLS on a WireGuard
interface; an Android client that lists what is buildable, watches a build,
and installs the result. Enrolment carries the token and the CA, so the
phone trusts exactly the machine that issued it and nothing else.

`AGENTS.md` is the working guide and `README.md` the configuration
reference. The shared tunnel-and-TLS code lives in `vendor/wg-app-link`,
which ai-app uses too.

History before this point was squashed away, and a stale `config.json` went
with it: nothing had read that file since the config moved to RON outside
the checkout, and what it still held was one machine's absolute paths and
the names of projects on it.

.dev-updater.ron

@@ -0,0 +1,47 @@
+// Read by Dev Updater -- this project's entry in its own list. Structured
+// as the body of the config: no outer parentheses, so nothing here is
+// indented for the sake of a wrapper.
+
+// What to call this project before there is a build to read a label from.
+label: "Dev Updater",
+
+// Where this project's own resources live. Read off the request path and
+// cached, because the `Script` variant would otherwise put a process
+// spawn on the manifest -- see `server/src/resources.rs`.
+resources: Ron("resources.ron"),
+
+// Walked in order, and the order is the point: the binary is built first
+// so that a failing APK build leaves the phone the APK it already had
+// rather than half of a matched pair.
+//
+// The server component is this process. That changes how it is *delivered*
+// -- restarting means exec-ing the binary just built, not asking the
+// script below to stop and start the code that is running (see
+// `restart.rs`) -- but nothing about how it is declared, installed or
+// reported on. The card is an ordinary one.
+components: [
+    Server(
+        name: "server",
+        // No cwd: this component is built and run from the checkout root,
+        // which is where the server looks for its own project. That is
+        // also what the generated unit takes as its working directory --
+        // started anywhere else this server finds no checkout of its own,
+        // and its card silently loses the branch line, its commit count
+        // and the Pull button.
+        build: "cargo build --release --manifest-path server/Cargo.toml",
+        // Managed, like anything else that just wants its binary kept
+        // running. Nothing about restarting *this* server lives in the
+        // script -- that is `restart.rs`, which defers the hand-over past
+        // the reply and spawns it detached. So there was nothing left for
+        // a script of its own to say.
+        service: Managed("server/target/release/dev-updater"),
+    ),
+    Apk(
+        name: "app",
+        // The command resolves against the project root and `cwd` says
+        // where to run it -- two different things, which is why this is
+        // not `./build-apk.sh`.
+        build: "app/build-apk.sh",
+        cwd: "app",
+    ),
+],