Work with Android's lock screen instead of around it

[windoze95]

Only Android's PIN protects an R1's data: storage is encrypted with a key tied to the PIN, and Android throttles guesses. robotOS's recovery cover can be bypassed through debugging, safe mode or other Android screens. This makes robotOS behave well once a PIN is set, and documents the setup.

• Button while locked: pressGate() routes a press to LOCKED when KeyguardManager.isDeviceLocked. The press then only wakes the lock screen and still silences a ringing R1. Each ignored press is recorded in the event log.
• Tap-to-sleep: ScreenPolicy.sleepNow() uses the root sleep key first, so Android's "lock after screen timeout" applies. Previously, once device admin was active, every tap called lockNow(), which locks immediately and would have demanded the PIN on every wake. lockNow() remains for lost mode and as the no-root fallback.
• Open with this R1's PIN (Add recovery-screen PIN access with gateway unlock after five failures #45): the recovery page shows the button when Android has a secure credential and the R1 isn't restricted. It launches createConfirmDeviceCredentialIntent. On RESULT_OK, WorkspaceClient.confirmedByOwner() confirms the current fence ticket, grace included.
  • A lost, revoked or cleared R1 is never opened.
  • The host's next answer still applies, so a lost reply recaptures at once.
  • robotOS never sees or stores the PIN.
  • Add recovery-screen PIN access with gateway unlock after five failures #45 asked for a hub unlock after five failures. Android's own guess throttling replaces that, and the PIN is no longer shared with Protect texting Hermes against a spoofed sender number #21.
• Tests: DeviceActivity.resetForTest() clears the static cover state between cases. Two existing tests had been passing only because of state left over from earlier cases.
• Docs: INSTALL.md gains "Lock it with a PIN": the PIN, a 15-minute lock delay with "Power button instantly locks" off, and device admin from Host & devices. HUB.md explains the model.

Validation:

• 387 Android tests, 5 new: the press gate, tap-to-sleep with and without root, the PIN path through Android's confirmation intent and result, and no PIN option for restricted or unsecured R1s. Lint has no new warnings.
• A signed 0.6.7 preflight ran normally on the R1, which has no PIN yet. The locked-button and PIN paths will be checked on hardware once the owner sets a PIN.

Closes #45