app: core-shizuku — dual-path shell-tier executor + probe, wired into the app

Ports the prober's validated Shizuku tier: AIDL UserService, the build-4
dual-path ShizukuRunner (UserService bind where it works, legacy
newProcess reflection fallback where it doesn't — exec_path records
which), and ShizukuProbe running the shell command battery, emitting a
shizuku-tier link.ip_monitor Test with per-device dumps as evidence.
Self-degrades to UNSUPPORTED without Shizuku.

Wired into RunViewModel (sets tiers.shizuku); app APK assembles. On-device
verification deferred — no device reachable at build time (flaky LAN
dropped the tablet, phone debugging off). Expect UserService on OnePlus,
newProcess on Lenovo per the prober.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

echolot-app/settings.gradle.kts

@@ -25,5 +25,6 @@ include(":core-protocol")
 include(":core-measurement")
 include(":core-engine")
 include(":core-probe")
+include(":core-shizuku")
 include(":app")
 include(":adb-beacon")