Engine: model catalog integrity, tests, and Android persistence wiring

[jsilvanus]

Pipeline 2.2 + 2.5–2.6 — cancellable model lifecycle, catalog integrity, and Android persistence wiring

This PR continues directly from #60 and makes the Engine model lifecycle safe under concurrent inference while making the model catalog authoritative and wiring Android persistence.

2.2 changes

• Bound inference admission and track per-model lifecycle state.
• Propagate model-close cancellation into cancellable native adapters.
• closeModel(modelId) blocks new admissions, interrupts active native inference, cancels queued requests, waits for all admitted work to stop, and then unloads the model while keeping its installed artifact.
• Expose closeModel() through EngineHttpServer and EngineService.
• deleteModel() now performs the same close/interrupt/unload sequence before removing the installed artifact.
• Preserve the deletion check-and-delete race protection under the same admission mutex.
• Add lifecycle tests covering cancellation and unload ordering.

2.5 changes

• Extend ModelDescriptor with explicit artifact format, trusted quantization, and catalog metadata.
• Stop /v1/models from deriving quantization from model IDs.
• Require markInstalled() to reference an existing catalog entry.
• Reject installed metadata whose digest conflicts with a catalog-pinned SHA-256.
• Reconcile stale installed rows against catalog/artifact state.
• Run model-catalog reconciliation during Engine service startup.
• Classify missing/incomplete/mismatched model integrity as explicit HTTP errors.
• Add database and HTTP tests for catalog authority and digest pinning.

2.6 changes

• Add an Android SQLDelight driver implementation for the existing storage/migration abstraction.
• Keep the repository-level schema/ DDL canonical and package it as Android assets.
• Add an Android RuntimeClient composition root using app-private Context.filesDir storage.
• Wire userDriver, projectDbFactory, and the runtime-managed project root.
• Share the persistence-backed RealRuntimeClient between MainActivity and the foreground runtime service.
• Deliberately leave ProjectLocker unset until Android file-lock semantics have real instrumentation coverage.

Remaining

• CI/build and Android device validation of the new storage driver and runtime wiring.
• Instrumentation coverage for persistence/restart and project locking.
• Real Android/device validation of model metadata, integrity failures, native cancellation, and close/delete behavior.
• Run persistence/run-executor wiring can follow once the Android storage seam is proven on device.