Let a test build be opened up, when asked

`adb shell run-as` refuses on a release build — "package not debuggable" — and
the app's private storage is then unreachable from the host. That storage is
where the face shards, the thumbnail store and the catalog live, so when a
device disagrees with the desktop about what it has synced there is no way to
find out which of them is right. An evening was spent guessing at exactly that.

`DARKROOM_DEBUGGABLE=1 ./docker/android/package.sh --install` now sets
`android:debuggable` through aapt2's `--debug-mode`, and nothing else changes.

Set through aapt2 rather than written into `AndroidManifest.xml` on purpose: the
flag then exists only for the build that asked for it, and a release build
cannot inherit it because somebody forgot to take it out again. A debuggable APK
lets any process on the device read this app's files, so it belongs on a test
tablet and nowhere else.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker/android/package.sh

@@ -71,6 +71,7 @@ SO="${CACHE}/target/jniLibs/${ABI}/libdarkroom.so"
 echo "==> packaging APK"
 "${HERE}/build.sh" env \
     ABI="${ABI}" RUST_TARGET="${RUST_TARGET}" \
+    DARKROOM_DEBUGGABLE="${DARKROOM_DEBUGGABLE:-}" \
     /work/docker/android/assemble-apk.sh
 
 # ---------------------------------------------------------------------------