dev-updater: build an app on the machine, install it on the phone

A Rust backend that discovers Android projects under configured roots,
builds one on request, and serves the APK over pinned TLS on a WireGuard
interface; an Android client that lists what is buildable, watches a build,
and installs the result. Enrolment carries the token and the CA, so the
phone trusts exactly the machine that issued it and nothing else.

`AGENTS.md` is the working guide and `README.md` the configuration
reference. The shared tunnel-and-TLS code lives in `vendor/wg-app-link`,
which ai-app uses too.

History before this point was squashed away, and a stale `config.json` went
with it: nothing had read that file since the config moved to RON outside
the checkout, and what it still held was one machine's absolute paths and
the names of projects on it.

test-projects/breakable/.dev-updater.ron

@@ -0,0 +1,15 @@
+// A test project for Dev Updater, not a real app. See ../README.md.
+//
+// The one that can be made to fail. Everything about a failed build is
+// awkward to produce with a real project and easy here: the card's failure
+// line, the build-log tab opening instead of the runtime one, a component
+// failing without stopping its siblings, and coloured compiler output
+// surviving the trip to the phone.
+label: "Test: Breakable",
+
+components: [
+    Apk(
+        name: "app",
+        build: "./build.sh",
+    ),
+],

test-projects/breakable/build.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+# Builds this test app -- unless ./break-the-build exists, in which case it
+# fails instead.
+#
+#   touch break-the-build     # the next build fails
+#   rm break-the-build        # and then stops failing
+#
+# A marker file rather than an environment variable, because the point is to
+# change the outcome of a build somebody else starts: Dev Updater runs this
+# from a service with its own environment, and the phone is where the button
+# is. The file is gitignored, so the checked-in state is "works".
+#
+# The failure writes colour on stderr on purpose. A real compiler marks its
+# own errors that way, the app renders the escapes rather than stripping
+# them (AnsiLog.kt), and this is the cheapest way to have something to look
+# at that is not Dev Updater's own build.
+set -eu
+
+if [ -f break-the-build ]; then
+    echo "@@progress 1/3"
+    echo "==> Compiling"
+    printf '\033[1;31merror\033[0m: cannot borrow `the_kettle` as mutable more than once\n' >&2
+    printf '  \033[1;34m-->\033[0m src/main.rs:12:5\n' >&2
+    printf '\033[1;31merror\033[0m: could not compile `breakable` (1 error)\n' >&2
+    echo "break-the-build is present, so this build failed on purpose." >&2
+    exit 1
+fi
+
+exec ../lib/build-apk.sh \
+    --package com.example.dutest.breakable \
+    --label "Test Breakable"