Release rish-mcp 1.0 source with Shizuku fallback

[turin-dev]

Summary

• align the Android agent, Go MCP server, npm setup CLI, and web package on source version 1.0.0; use Android versionCode 10000 so legacy v0.5 installs can upgrade
• add an optional Shizuku UserService backend, prefer uid-2000 Shizuku when explicitly authorized, and retain paired on-device ADB as an automatic fallback
• reject root-mode Shizuku, avoid replaying dispatched shell commands during backend failure, cap command size/time/concurrency, and publish live backend metadata through the relay
• isolate adb-shell provisioning behind a DUMP-protected activity, harden ADB key handling, normalize relay URLs, prevent duplicate reconnects, and exclude secrets from Android backup
• remove the nonfunctional Firebase receiver/dependencies, add Android lint to CI, and update setup/docs for the actual 1.0 behavior

Validation

• Android Docker: gradle --no-daemon lintDebug testDebugUnitTest assembleDebug (25 tests; lint 0 errors)
• APK: versionName 1.0.0, versionCode 10000, minSdk 26, targetSdk 35; 9,935,630 bytes; SHA-256 E663342EAD21057C3AF07D6620F409AA52CAB4CBB5B3671D199DF868EE2B3CD8
• Go on Windows: go test -count=1 -timeout=180s ./..., go vet ./..., go build ./...
• Go in Linux Docker: go test -race -count=1 -timeout=240s ./...
• CLI: 9/9 tests, syntax check, npm audit (0 vulnerabilities)
• Web: ESLint, TypeScript/Next production build, npm audit (0 vulnerabilities)

Release boundary

This remains a draft. No signed APK, agent-v1.0.0 tag, npm publication, deployment, or release should happen until Shizuku permission/binding, wireless ADB pairing, backend fallback, and real shell execution are verified on physical phone/watch hardware.