app: an IMS network is not a blocked measurement

rmnet_data1 on the OnePlus is the carrier's IMS/VoLTE network: it carries
IMS&MMTEL but neither INTERNET nor NOT_RESTRICTED, so binding needs
CONNECTIVITY_USE_RESTRICTED_NETWORKS - signature-level, unobtainable.
EPERM there is permanent and says nothing about any network's health, but
the constraint detector counted it, so a phone with VoLTE reported
'measurement blocked' on every run and every verdict came out
INCONCLUSIVE. Capabilities now decide: networks an app may never bind are
recorded as app_usable:false in networks[] and skipped, rather than
reported as something the run failed to do.

Also retires the 'while it tears down' wording, which was a guess that
turned out to be wrong - the refusal outlasts the VPN indefinitely, so
the text now names the VPN as the usual cause without asserting a
timeline it cannot know.

App version 0.2.4.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/measurement-schema.md

@@ -111,12 +111,24 @@ A run may exercise several networks simultaneously (Wi-Fi + cellular + USB ether
   "changes": [
     { "at_mono_ns": 91000000000, "kind": "lost | gained | link_changed",
       "detail": { /* new link snapshot or diff */ } }
-  ]
+  ],
+  "app_usable": true
 }
 ```
 
 `routes[].proto` and lifetime fields are Shizuku-tier data (`ip route`/`ip addr`); app-tier snapshots leave them absent — absence means "not observed", never "not present".
 
+`app_usable` records whether an ordinary app may send on this network at all. Android lists the
+carrier's special-purpose networks — IMS/VoLTE, MMS, XCAP — alongside the real ones, and they
+carry neither `INTERNET` nor `NOT_RESTRICTED`; binding to one needs
+`CONNECTIVITY_USE_RESTRICTED_NETWORKS`, which is signature-level and unobtainable for a normal
+app. Those networks are therefore permanently unmeasurable, and that is a property of Android's
+permission model rather than of the link. They stay in `networks[]` because they are genuinely
+present — an interface silently missing from the inventory is its own kind of lie — but a
+consumer must not read the absence of tests against them as a fault, and they are **not**
+`constraints.unmeasured_networks` (§3): nothing was prevented, the run was never entitled to
+measure them.
+
 ## 5. `server_sessions[]`
 
 ```json