app: fold the prober's validated capabilities into core-probe

traceroute.udp4 lands as TracerouteProbe: ICMP time-exceeded read off the
socket error queue via Os.recvmsg(MSG_ERRQUEUE) through the reflection
facade the prober validated on both devices - no root, no raw socket, and
the C-over-JNI shim stays dead. Emits the schema's TracerouteEvidence with
rtt_ns. OsAbi carries the hardcoded sockopt ABI numbers across, including
the measured fact that Os.getsockoptInt exists on neither device, so PMTU
must come from the errqueue, never getsockopt(IP_MTU).

local.mdns_inventory lands as MdnsInventoryProbe with both hardware-bought
lessons intact: the meta-query lies (0 results beside live services on both
devices), and 4s of listening misses what 10s catches.

App version 0.2.2.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

echolot-app/app/src/main/kotlin/app/echo_lot/app/RunViewModel.kt

@@ -403,6 +403,10 @@ class RunViewModel(app: Application) : AndroidViewModel(app) {
             RouterIdentityProbe(entries),
             IcmpProbe(entries, v6 = false),
             IcmpProbe(entries, v6 = true),
+            // Folded from the prober after hardware validation: errqueue traceroute (no root,
+            // no JNI) and the mDNS service inventory / VLAN-leakage detector.
+            app.echo_lot.probe.TracerouteProbe(),
+            app.echo_lot.probe.MdnsInventoryProbe(),
             CaptivePortalProbe(entries),
             // Canary zone served by the Echolot probe server (probe-protocol §6.1). Hardcoded to
             // the reference deployment until profiles/enrollment land in the UI.