reports: build-5 runs on both devices — new toolchain is behaviour-neutral

TB330FU (A15/SDK35) and CPH2747 (A16/SDK36) both re-run on the AGP 9.2 /
Gradle 9.6 / Kotlin 2.2.10 / JDK 25 / targetSdk 36 toolchain. Every probe on
both devices keeps the verdict it had on the previous build (tablet vs build-4,
phone vs build-3), so the upgrade changed no observed capability.

Dual-path Shizuku executor now confirmed on the current toolchain on both:
phone exec_path=UserService, tablet exec_path=newProcess fallback, both 7/7.

Collection-loop gotchas recorded in build-status.md, found while driving the
phone over USB:

- icmp.ping6's verdict is topology-dependent, not build-dependent. A run with
  only 2 networks up reported UNSUPPORTED; with cellular present it is the
  expected "echo reply on cellular only". Always read it against
  link.snapshot's network_count from the same report.
- The Shizuku permission dialog times out after 30 s and the probe logs
  "permission not granted" at ~30027 ms. Grant it before starting a run.
- uiautomator dump can report a stale idle state right after a tap; the
  exported JSON's durationMs values are the ground truth for completion.

CLAUDE.md's collection loop is updated — over USB the run is fully driveable
via am start / input tap / run-as cat, no manual export needed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -63,23 +63,27 @@ First build downloads AGP/Compose/Shizuku from Google Maven + Maven Central.
 
 - **Prefer USB for adb.** Wireless debugging dies constantly: probe runs churn the wifi the
   debug link rides on, the Lenovo tablet's ZUI power management kills the listener anyway, and
-  the port rotates on every restart. Deploys over wireless work between runs; never drive a
-  probe run over adb.
-- Collection loop that works: install over adb → the **user** runs the probes and exports the
-  JSON manually → archive it under `echolot-prober/reports/` and record findings in
-  `docs/build-status.md`.
+  the port rotates on every restart. Never drive a probe run over *wireless* adb.
+- Collection loop over USB, fully driveable by Claude: install → `am start` → tap "Run all
+  probes" → poll `uiautomator dump` until the button label returns to "Run all probes" → tap
+  "Export JSON" → the report lands in `cache/reports/` and comes back via
+  `adb shell run-as app.echo_lot.prober cat …` (no need to drive the share sheet; dismiss it
+  with BACK). Archive under `echolot-prober/reports/`, record findings in `docs/build-status.md`.
+- Bash-tool `adb shell` calls with absolute device paths get mangled by Git Bash path
+  conversion (`/data/…` → `C:/Program Files/Git/data/…`); use the PowerShell tool for those.
 - Bump `versionCode` on every deployed prober change — it shows on screen and as `proberBuild`
   in the report; that's how a report is matched to a build.
 - Known devices: OnePlus 15 (CPH2747, A16) — Shizuku UserService works;
   Lenovo TB330FU (A15, multi-user) — UserService never binds, the `newProcess` fallback carries
   it. Full history in build-status.md.
-- Gradle needs JDK 17–21 (`JAVA_HOME`); a system JDK 25 breaks AGP 8.7. On machines with
-  Android Studio, its `jbr` directory works.
+- As of the AGP 9.2.0 / Gradle 9.6.0 / Kotlin 2.2.10 bump, JDK 17+ (including 25) works —
+  AGP 9 requires Gradle 9.1.0+ and Kotlin 2.2.10+ as its minimum KGP version. On machines with
+  Android Studio, its `jbr` directory works as `JAVA_HOME`.
 
 ## Likely next steps
 
 1. Run on physical devices; collect JSON reports across Android versions/vendors.
-2. If `trace.errqueue_reachable` is PARTIAL, add the C-over-JNI errqueue shim (recvmsg + cmsg parse)
-   as a `:native` module and a real `traceroute.udp4` probe.
+2. ~~C-over-JNI errqueue shim~~ — not needed; `trace.errqueue_reachable` and `traceroute.udp4`
+   are SUPPORTED on both known devices via `Os.recvmsg` + `StructMsghdr` reflection.
 3. Fold the confirmed capabilities + Shizuku dump-format samples back into the production
    `core-probe` / `core-shizuku` modules.