fix: contain managed ADB transport to its lease target
Summary
Pin managed Android ADB commands and background spawners to the lease's serial and private localhost server. Foreign serials, ports, global selectors, and server-mode overrides now fail before native dispatch; unqualified commands cannot inherit another target.
ADR 0021 prerequisite for reviewed managed automation, based on #2308. Child sockets are explicitly cleared and server administration is denied as defensive hardening. Ordinary and provider transports retain their existing behavior. Scope: 5 files, 268 gross lines.
Validation
Tested commit: 65bcfb1696037872ff2159a19097f18153ea2731.
The exact-head pnpm check:affected --run passed, including 3,984 tests across 521 files, build, typecheck, lint, layering and Fallow.
Independent adversarial review found no concrete issues. Native ADB fixtures cover execution, background spawning, preconstructed executors, concurrent private servers, inherited environment, and parser escape attempts; regression tests were observed red before the fixes.
Managed request admission and publication remain unimplemented in this layer. Live verification requires that later path and an allocator-owned emulator; fixture evidence does not establish merge readiness. GitHub remains authoritative for native, provider, and coverage lanes.
Docs and skills are unchanged because this is an internal transport fix.