prober build 3: raise Shizuku bind window for slow first spawn; archive build-2 reports

Build-2 matrix (OnePlus 15/A16 + Lenovo TB330FU/A15) delivered the big
answer: traceroute.udp4 reads real hops via pure-Kotlin MSG_ERRQUEUE on
BOTH devices — the C-over-JNI shim is dead for Android 15+. Per-network
ICMP works as designed (phone ping6: cellular-only with topology
evidence). mDNS meta-query confirmed broken on both devices while
concrete types find real services — production must enumerate types.
Network finding: hudeWLAN RAs advertise a v6 default route but no global
prefix — the LAN's IPv6 is half-broken (nice dogfood case).

Tablet Shizuku bound 0/7 (binder alive, permission granted): first-spawn
dex extraction on slow storage suspected — bind window now 25s + one
retry. versionCode 3.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

echolot-prober/app/src/main/java/app/echo_lot/prober/shizuku/ShizukuRunner.kt

@@ -89,8 +89,16 @@ class ShizukuRunner(private val context: Context) {
             override fun onServiceDisconnected(name: ComponentName?) {}
         }
         try {
+            // 25 s + one retry: the Lenovo tablet (Android 15) never bound within the old 10 s —
+            // the first-ever UserService spawn extracts dex on slow storage. Binder alive and
+            // permission granted, so a longer wait is the honest next attempt, not a workaround.
             Shizuku.bindUserService(serviceArgs, conn)
-            val svc = withTimeoutOrNull(10000) { bound.await() }
+            var svc = withTimeoutOrNull(25_000) { bound.await() }
+            if (svc == null) {
+                runCatching { Shizuku.unbindUserService(serviceArgs, conn, true) }
+                Shizuku.bindUserService(serviceArgs, conn)
+                svc = withTimeoutOrNull(25_000) { bound.await() }
+            }
             if (svc == null) {
                 commands.forEach { (key, _) -> out[key] = "SHIZUKU_BIND_TIMEOUT" }
                 return out