fix(android): wake gateway on cold foreground

[Codename-11]

Summary

Refs #495 and #528.

Authenticated Gateway-only connections could remain on waking gateway during the first foreground launch because Chat required chatReady before admitting the visible owner that opens /api/ws; chatReady itself requires the resulting gateway.ready. Admit the foreground Gateway owner while availability is still unresolved, and make client binding order-independent so the read-only observation socket opens whether visibility or the client arrives first.

Changes

• Let a foreground Gateway-owned Chat open socket-only observation from GatewayAvailability.Unknown; confirmed sign-in and unsupported-protocol failures remain terminal.
• Start the same bounded warmup when a Gateway client binds after Chat is already visible.
• Cover both client/visibility orderings and assert that cold observation sends no session.resume, session.activate, prompt.submit, or session.interrupt.
• Add a focused API 36 Compose/instrumentation regression and a provider-free Gateway fixture scenario.
• Keep current-upstream conformance compatible with the upstream helper that now owns the locked live-session snapshot.
• Add one Unreleased changelog entry.

Verification

Exact PR head: 44bbb16cd30bd0bf189f7f20b0f84f1061e128eb. The locally tested Android, fixture, and conformance source tree is identical to fix commit 273e3f5affe3a5a6274d2b340f55f84d7fbcc049; the merge commits only incorporate current dev plugin/docs and Dashboard Basic Auth work plus all Unreleased changelog entries. The focused Sideload JVM slice was rerun after the final dev merge and passed.

• scripts/android-lane.ps1 gradle :app:testSideloadDebugUnitTest --tests 'com.hermesandroid.relay.ui.RelayAppStatusTest' --tests 'com.hermesandroid.relay.viewmodel.ChatViewModelGatewayInboundTurnTest' --console=plain — 154 tests passed; zero failures/errors/skips.
• scripts/android-lane.ps1 gradle :app:testGooglePlayDebugUnitTest --tests 'com.hermesandroid.relay.ui.RelayAppStatusTest' --tests 'com.hermesandroid.relay.viewmodel.ChatViewModelGatewayInboundTurnTest' --console=plain — 154 tests passed; zero failures/errors/skips.
• scripts/android-lane.ps1 gradle :app:compileSideloadDebugAndroidTestKotlin --console=plain — passed.
• scripts/android-lane.ps1 gradle :app:standardPhoneApi36SideloadDebugAndroidTest '-Pandroid.testInstrumentationRunnerArguments.class=com.hermesandroid.relay.viewmodel.GatewayForegroundRecoveryInstrumentedTest#authenticatedUnknownColdLaunch_opensObservationSocketWithoutLifecycleBounce' --console=plain — one API 36 managed-device test passed; Sideload debug app and test APKs assembled.
• python -m unittest discover -s test-fixtures/vanilla-gateway/tests -p 'test_*.py' — 28 tests passed.
• python -m unittest scripts.tests.check_gateway_scenario_conformance_test — 8 tests passed.
• python scripts/check-gateway-scenario-conformance.py <clean-current-upstream> --scenario-manifest test-fixtures/vanilla-gateway/vanilla_gateway/scenarios/cold_start_observation.json — passed against clean NousResearch/hermes-agent commit 145c713f1691b44bc485ce0ce4818cdb0e9c396b; no Gateway runtime or provider calls were started.
• python scripts/check-android-locales.py — 12 catalogs passed.
• python scripts/check-user-docs-locales.py — five locales and five core pages passed.
• python scripts/check-android-collection-apis.py — passed.
• python scripts/check-android-release-notes.py — passed.
• python scripts/check-version-tracks.py — passed.
• git diff --check — passed.

The broader no-manifest conformance diagnostic still reports pre-existing checker drift in five unrelated upstream contracts; the selected gateway.session_active_list contract used by this change passes. Required PR CI owns full Android lint, the focused CI shard, both-flavor debug assembly, native compatibility, and the remaining path-aware checks on this exact head.

Screenshots

No visual change. The API 36 managed-device test exercises the lifecycle/Compose admission path without changing layout.

Compatibility / risk

Standard Hermes remains on the upstream Dashboard/Gateway path and requires no Hermes-Relay Plugin or server change. Cold foreground work opens only the shared observation socket; passive startup still cannot attach, resume, submit to, activate, or interrupt a session. Existing reconnect cooldowns, bounded retry episodes, route generations, and terminal auth/unsupported dispositions remain intact.

Physical Android 16 cold-start certification over LAN and Tailscale remains a release gate; no phone install or physical-device claim is included in this PR.

Open #559 touches nearby Chat/Gateway files but is held separately and is not required for this fix. This branch starts from origin/dev after #566 and includes merged #567.

Lineage / contributor credit

• Source PR(s): N/A; independent fix for [Bug]: Stuck on "waking gateway / waiting for gateway" until app is backgrounded and resumed #495/[Bug]: v1.14.0 extremely laggy — login/gateway stuck and media attachments repeatedly reload (rolled back to v1.13.2) #528.
• Attribution preserved by: no contributor history was rewritten.

Checklist

• Target branch is dev, unless this is a dev → main release PR or a focused production-tag hotfix PR to main
• Scope is focused and related issues/PRs are linked
• Android changes: focused tests passed for both flavors; exact-head lint/build are running in required CI
• Translation changes: N/A; both locale validators also passed
• Server/plugin changes: N/A
• Desktop changes: N/A
• Docs/site changes: changelog only; release-note and version checks passed
• UI changes were tested on API 36; physical LAN/Tailscale acceptance remains explicitly outstanding
• Commit messages follow Conventional Commits
• CHANGELOG.md is updated for user-visible changes
• Public writing hygiene checked: no secrets, private infrastructure, personal names, or AI/process narration
• Salvaged/replacement work links source PRs and preserves contributor authorship, or N/A