Develop on the emulator only, real device gets the signed APK; pin ezvpn v0.0.42

[andrewchen5678]

Summary

• Development, debug installs, and testing target the arm64 Android VM at 10.22.35.66:5555; the physical Nexus 7 only ever receives the signed release APK.
• scripts/run-device.sh defaults to the emulator serial, exports ANDROID_SERIAL for Gradle, refuses the release device, and drops the ro.kernel.qemu emulator rejection.
• New scripts/install-release-apk.sh is the only script that touches the real device: verifies the APK with apksigner, refuses debug/unsigned builds, installs with one reconnect retry, optional --build / --launch.
• CLAUDE.md / README.md document the split, the -s / ANDROID_SERIAL targeting rule, and scrcpy for the emulator screen.
• Pin ezvpn v0.0.42 (Close the iroh endpoint gracefully on mobile stop and release 0.0.42 ezvpn#56: graceful endpoint close on disconnect, so the server frees the lease immediately instead of at the 30 s idle timeout). versionName 0.0.42, versionCode 3.

Test plan

• ./gradlew :tunnelcore:test :app:testDebugUnitTest :app:assembleDebug with the pinned core (all three ABIs packaged)
• scripts/run-device.sh --pinned installs on the emulator only ("Installed on 1 device", versionName 0.0.42)
• E2E on the emulator with the pinned v0.0.42 core against a 0.0.42 server on the WSL host: handshake, ping both ways, HTTP + 1 MiB sha256 match, direct path; disconnect closed the endpoint in 56 ms and the server logged it within the same second

🤖 Generated with Claude Code

https://claude.ai/code/session_01QedowxAkQAV7HoeJu8ZYZC