Add safe Memory Editor controls and runtime UI

[H3nb]

Summary

This is PR 2 of 2 for the production Memory Editor milestone in #108. It is intentionally stacked on PR 1; review and merge that foundation first, then retarget this PR to alpha.

• completes CandidateId-based refresh, bounded relocation recovery, result remove/keep, Advanced Group Search, guarded edit, Watch, labels, and fail-closed Freeze modes
• adds a lazily bound translucent Compose overlay inside MicroActivity, reachable from the existing runtime Back menu
• groups type aliases by live address while preserving explicit type-level selection for writes
• adds known/unknown search and refine controls, history Undo, paging, live visible refresh, edit/remove/keep/watch/freeze/copy actions, and English/Indonesian resources
• handles portrait, compact landscape, safe-drawing/IME insets, dark theme, accessible touch targets, system Back, and physical/remapped Back
• vendors only the Phosphor MagnifyingGlass and X vectors and includes the complete MIT notice in both attribution surfaces

Safety properties audited

• all writes accept CandidateIds only; there is no raw-address write API or unlimited Edit All path
• multi-edit and Freeze setup are capped at a provisional 32 explicit candidates
• every write requires a stable identity, expected-value validation, exact-width same-page/aligned write, readback, and best-effort restore on failure
• stale identity triggers a fresh target-side resident-range snapshot and bounded recovery; more than 32 recovery candidates fails closed without committing a partial state
• empty, duplicate, stale, foreign, or non-Watch CandidateId sets are validated before filter/edit/watch/freeze mutations
• Watch state is independent from search history, survives search clear/Undo, and is wiped on runtime-generation loss
• Freeze runs on the single :memory_engine worker, writes only on rule violation, and independently pauses unsafe records
• no scan/recovery runs on Android UI/input callbacks; the UI Binder client pages on a dedicated executor and live polling stops when hidden
• both services remain non-exported and target generation, not PID alone, scopes all operations

Validation

Passed locally:

• :app:lintEmulatorDebug
• :app:test and :dexlib:test
• :app:validateEmulatorDebugScreenshotTest
• :app:assembleEmulatorDebug
• :app:assembleEmulatorDebugAndroidTest
• :app:assembleEmulatorRelease including R8/resource shrinking
• release native build for arm64-v8a, armeabi-v7a, x86, and x86_64
• cppcheck warning/performance/portability pass for the memory engine and target probe
• manual visual review of portrait, landscape-results, and dark landscape-Watch baselines

Draft / release-gate limitations

No ADB device was attached in this environment. The Android 16 physical capability probe, Bounce/Green Farm workflows, multi-edit partial-failure behavior, relocation, Freeze identity-loss behavior, and soak/RSS acceptance matrix from #108 remain mandatory before this can be called stable.

The 32-candidate write/recovery caps and 750 ms Freeze interval are deliberately conservative provisional values. Recommendation: keep the PR Draft until physical benchmarks confirm them. If recovery profiling shows repeated full scans are material, add a shared recovery pool as a measured follow-up instead of increasing the cap. Select all results is also intentionally not exposed while a session may contain up to one million typed candidates; the current safe UI offers Select visible and Invert visible, while all mutation paths remain explicit and bounded.

[H3nb]

Superseded by PR 116 after the requested branch rename to feature/memory-editor-ui. PR 116 remains stacked on the renamed engine branch.