fix: remediate automation security advisories

[emi-ran]

Summary

Closes draft advisory remediation for GHSA-gf6v-xfj2-6xpr, GHSA-3g8m-5wv2-4fqx, GHSA-9w6j-9fmh-gjh2, GHSA-j483-c2w9-6v38, and GHSA-mfx2-3xcj-75qv.

• Gates background NFC discovery behind explicit visible confirmation; trusted foreground ReaderMode remains automatic.
• Pins webhook TCP delivery to validated public IPs, preserves TLS hostname verification, and blocks rendered-header injection.
• Bounds and authorizes SMS/notification intake and execution; prevents replay after engine disable.
• Adds durable rule execution leases and mutation revocation for queued/cooldown-controlled runs.
• Hardens release provenance and documents required repository tag rules/environment secret setup.

Verification

• python -X utf8 scripts/test_lint_resource_contracts.py
• ./gradlew.bat testDebugUnitTest lintDebug assembleDebug assembleRelease -PreleaseSigningRequired=false --no-daemon --console=plain

Follow-up

• Wireless ADB device was offline during final validation; debug APK install/launch remains pending.
• Repository admin setup remains required: create protected release-signing environment, migrate signing secrets, and enable documented v* tag ruleset. docs/RELEASE_SECURITY.md has exact steps.