bridge: persist per-thread collaboration mode

[0xSero]

Summary

• persist non-default per-thread collaboration mode in a bounded, Rust-owned thread_modes.json
• restore persisted mode through the canonical reducer on list, lifecycle, and hydrated snapshots
• reconstruct the Implement Plan affordance on cold hydration only when the latest proposed plan has no later user turn
• register each platform's existing private mobile-preferences directory through one generated AppStore method
• retain explicit Default cleanup and avoid resurrecting a prompt dismissed during the current process

Root cause

The pinned app-server protocol's authoritative Thread data returned by list/read/resume does not expose collaboration mode. ThreadSnapshot::from_info therefore rebuilt every process-cold thread in Default mode, while live Plan-item handling only changed reducer memory. Process death lost both that mode and the transient implement-plan prompt.

Validation

• cargo test --manifest-path shared/rust-bridge/Cargo.toml -p codex-mobile-client --lib — 790 passed, 5 ignored
• generated Swift and Kotlin UniFFI bindings; confirmed setThreadModePersistenceDirectory on both surfaces
• Android :app:compileDebugKotlin :app:testDebugUnitTest — BUILD SUCCESSFUL
• iOS make ios-sim-fast — BUILD SUCCEEDED
• post-rebase incremental iOS simulator xcodebuild ... build — BUILD SUCCEEDED
• git diff --check origin/main...HEAD — passed

Focused tests cover Default removing the durable entry, restart restoration, Plan-item auto-detection persistence, cold implement-prompt reconstruction, dismissed-prompt preservation on ordinary refresh, later-user-turn suppression, and the 512-entry storage bound.

Known acceptance gap

This remains a bounded mobile fallback because upstream cannot round-trip collaboration mode today. It cannot observe a mode change made by another client, and a thread will not match its local entry if the same server is later registered under a different server_id. An authoritative upstream thread field should supersede the local fallback when available.

This PR stays draft until an installed iOS/Android app is killed and relaunched against a live Plan-mode thread to confirm the full cold-relaunch UX.

Closes #100

[0xSero]

The queued Mobile CI run was intentionally canceled to give the merge-blocking clean-runner #221 gate the next available slot. #220 already has a green local 790-test Rust suite, generated Android compile/tests, and clean iOS simulator build, and it remains draft for installed kill/relaunch acceptance. Rerun Mobile CI when that physical acceptance is ready; the cancellation is scheduling, not a test failure.