prober: archive run 2 — all three report-driven fixes verified on device

multinetwork now SUPPORTED (wifi+cellular bound concurrently; the cellular
request surfaced a second dual-stack PDN), Shizuku battery 7/7 in 2.9s
(was 4/7 in 34s), rtt_ms locale-clean. Remaining probe improvements
(per-network ping6, longer mDNS/ip-monitor windows) noted in build-status.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/build-status.md

@@ -84,7 +84,19 @@ Prober bugs the run exposed (all fixed same day):
 - `rtt_ms: "38,1"` → device locale leaked into report numbers, now `Locale.ROOT`;
 - 3/7 Shizuku commands `SHIZUKU_BIND_TIMEOUT` → bind/unbind-per-command raced Shizuku; now one
   bind per battery (`execBatch`).
-Open: re-run on-device to confirm the multinetwork + Shizuku fixes; then re-export.
+Run 2 (same device, fixed APK — `…-run2.json`) confirmed all three fixes:
+- `multinetwork.request_and_bind` **SUPPORTED** — wifi + cellular acquired and bound concurrently
+  (downKbps 39094 / 13231); requesting cellular even brought up a second, dual-stack PDN
+  (`rmnet_data2`, private v4 /30 + carrier-NAT DNS) next to the IPv6-only default PDN — exactly
+  the per-network behavior the production app needs.
+- Shizuku battery **7/7** in 2.9 s (was 4/7 in 34 s): full ARP/NDP neighbor table, `ip addr`,
+  IpClient ProvisioningConfiguration incl. SSID/BSSID and APF caps (v6000, 4096 B).
+- `rtt_ms: "32.0"` — locale fix holds.
+Still open (probe improvements, not blockers): ping6 should bind per-network (still EAGAIN via
+v4-only default wifi); mDNS window too short to see real services (0 found on a network that has
+them); `ip monitor` 2 s window caught nothing on a quiet net — consider longer/event-triggered
+capture; IP_MTU read via getsockoptInt reflection unavailable — reader belongs in the errqueue
+shim if that lands.
 
 ## Next steps
 1. Build locally, run on several physical devices (varied Android versions/vendors), collect the