#4156 fix(android): retry a refused helper start once, and scope the session fake's stall to its helper

Summary

Retry a system-refused Android helper start once after resetting its runtime, only before a helper session becomes ready. Require a nonzero unsignaled exit, INSTRUMENTATION_FAILED, and the exact ActivityManagerService refusal envelope. Preserve all other failures and expose androidSnapshotHelperStartRefused.

Fix the cancellation test fake so an early cancellation and a stalled request both prove clean helper retirement. Eight files; Android capture and its tests only. No scope expansion to #4005.

Fixes #4030
Fixes #4109

Validation

Tested head: d293daf99b9708f71530f1f275858f63f60accee; base: a42bc352827f1c13d264f805bd2a75cdb2c94eec.

• pnpm build and pnpm build:android: passed. Focused retry/session tests: 18 passed.
• pnpm check:affected --run --head d293daf99b9708f71530f1f275858f63f60accee: passed (run-VnGg2s, exactCommit=true, checkoutChanged=false).
• Head CI: 17 passing checks, one skipped cache matrix job; Android/Apple/Linux smoke, integration, and coverage passed.
• Android 16/API 36, Pixel_7_CI: successful helper snapshot, then forced refusal in the same daemon/session. Retry phase, two one-shot attempts, and final refusal marker observed. Raw stdout matches the existing gate.
• Restore comparison: base 20/20 and head 20/20 first snapshots succeeded; no refusal/retry. Captures observed the launcher's ANR system surface. Recovery from the reporter's transient current-helper refusal remains unverified.
• Commands and raw evidence. No code changes were needed in this follow-up.