Make tests and baseline profiles backend-independent

[rovkinmax]

Summary

• Route integration and API tests through deterministic local MockWebServer fixtures.
• Add pinned-loopback endpoint controls and instrumentation-only network isolation for baseline-profile generation.
• Refresh checked-in baseline and startup profiles from the mock backend; remove credential/OAuth bootstrap.
• Harden startup proof after adversarial grill review: require a real target Home API request, fence the target before verification, and wait for request-journal quiescence.
• Filter instrumentation-only classes from generated production profiles and require an explicit leased ANDROID_SERIAL.

Compliance and review

• Final Compliance, Standards, Specification, Verification Gate, and two adversarial grill passes found no remaining task-scoped blocker.
• No credentials, token caches, authenticated payloads, or raw runtime evidence are included.
• The instrumentation flavor is documented as the dedicated hermetic harness; fail-closed coverage is explicitly scoped to current CUJs and known ProxySelector-aware stacks.

Verification

• Host dev/prod unit tests and app/baselineprofile instrumentation Kotlin compilation passed.
• Final BaselineMockBackendTest: 7 tests, 0 failures/errors/skips on leased emulator-5556; XML SHA-256 78068af335f27d42706d3f9e4f3de674f5f02f2756876236fce5fc2ff7827b3b.
• Mock-backed :app:generateBaselineProfile passed after hardening.
• StartupBenchmarks#startupWithProfile: 1/1 passed after hardening.
• :app:compileProdReleaseArtProfile passed.
• Filtered generated profiles contain zero com/kino/puber/profile/ rules:
  • baseline SHA-256 10cb9a78a0c1f4e41f4c4c0b27649fea5635290c096e9c14150ed1be85a397ae
  • startup SHA-256 16242bf398b41e1b9d48a49c0726bbd095b14352d1ad40972d0fb4b9bea250dd
• Script rejects unset or blank ANDROID_SERIAL; bash -n and git diff --check pass.
• Emulator lease was released and verified unlocked after every device run.

Known non-blocking results

• Five full instrumentation-suite UI/focus failures reproduce identically at pinned baseline d7488612c84b1941581d4c46e08d358ddeadc26e; PUB-77 neither introduced nor worsened them.
• Existing baseline-wide Detekt debt is outside task paths.
• Full signed prod packaging still requires repository release signing credentials; ART-profile compilation itself passed.

Delivery

• Branch: PUB-77
• Merge strategy: rebase
• Do not force-push or merge automatically.