Add safe Memory Editor controls and runtime UI

[H3nb]

Summary

This is PR 2 of 2 for the production Memory Editor milestone in #108. It is intentionally stacked on PR #115; review and merge that foundation first, then retarget this PR to alpha.

• completes CandidateId-based refresh, bounded relocation recovery, result remove/keep, Advanced Group Search, guarded edit, Watch, labels, and fail-closed Freeze modes;
• adds a lazily bound translucent Compose overlay inside MicroActivity, reachable from the existing runtime Back menu;
• groups type aliases by live address while preserving explicit type-level selection for writes;
• adds known/unknown search and refine controls, history Undo, paging, live visible refresh, edit/remove/keep/watch/freeze/copy actions, and English/Indonesian resources;
• handles portrait, compact landscape, safe-drawing/IME insets, dark theme, accessible touch targets, system Back, and physical/remapped Back;
• vendors only the Phosphor MagnifyingGlass and X vectors and includes the complete MIT notice in both attribution surfaces.

Core scaling refinements

• live/write relocation recovery now batches up to the existing bounded recovery set into one resident-memory scan, instead of potentially rescanning the full target once per candidate;
• known-search relocation recovery indexes only the old (type, identity) keys actually being recovered, avoiding the previous old×fresh comparison path and avoiding a full index of a large fresh pool;
• result states build a sparse checkpoint every 256 logical addresses, so deep paging jumps near the requested group instead of walking the result vector from the beginning on every page;
• Advanced Group Search uses the rarest term as a prefilter while preserving the original first-term window semantics;
• narrow signed integer edits now retain canonical raw-width bits, preventing sign-extended metadata from disagreeing with subsequent raw reads/recovery.

Safety properties audited

• all writes accept CandidateIds only; there is no raw-address write API or unlimited Edit All path;
• multi-edit and Freeze setup are capped at a provisional 32 explicit candidates;
• every write requires a stable identity, expected-value validation, exact-width same-page/aligned write, readback, and best-effort restore on failure;
• stale identity triggers a fresh target-side resident-range snapshot and bounded recovery; more than 32 recovery candidates fails closed without committing a partial state;
• batch recovery still requires a unique type/value/identity match per candidate; zero matches become Lost and multiple matches become Ambiguous;
• empty, duplicate, stale, foreign, or non-Watch CandidateId sets are validated before filter/edit/watch/freeze mutations;
• Watch state is independent from search history, survives search clear/Undo, and is wiped on runtime-generation loss;
• Freeze runs on the single :memory_engine worker, writes only on rule violation, and independently pauses unsafe records;
• no scan/recovery runs on Android UI/input callbacks; the UI Binder client pages on a dedicated executor and live polling stops when hidden;
• both services remain non-exported and target generation, not PID alone, scopes all operations.

Validation

The stacked PR remains mergeable on top of current PR #115. The previous local validation covered:

• :app:lintEmulatorDebug
• :app:test and :dexlib:test
• :app:validateEmulatorDebugScreenshotTest
• :app:assembleEmulatorDebug
• :app:assembleEmulatorDebugAndroidTest
• :app:assembleEmulatorRelease including R8/resource shrinking
• release native build for arm64-v8a, armeabi-v7a, x86, and x86_64
• cppcheck warning/performance/portability pass for the memory engine and target probe
• manual visual review of portrait, landscape-results, and dark landscape-Watch baselines

PR #115 head 736ec71b passes Android CI. GitHub has not emitted a workflow run for the latest PR #116 connector-authored head yet, so the new batch-recovery/checkpoint changes still require the normal CI/build pass before merge.

Draft / release-gate limitations

No ADB device was attached in this environment. The Android 16 physical capability probe, Bounce/Green Farm workflows, multi-edit partial-failure behavior, relocation, Freeze identity-loss behavior, and soak/RSS acceptance matrix from #108 remain mandatory before this can be called stable.

The 32-candidate write/recovery caps and 750 ms Freeze interval remain deliberately conservative provisional values. Batch recovery is now shared across the bounded recovery set; physical profiling should verify its latency and RSS before changing those caps. Select all results is also intentionally not exposed while a session may contain up to two million typed candidates; the current safe UI offers Select visible and Invert visible, while all mutation paths remain explicit and bounded.

[H3nb]

Superseded by PR #117. The complete Memory Editor foundation + runtime UI stack is now consolidated there so review, CI, fixes, and benchmarking can happen against one authoritative branch.