fix(sdk): scope released entries and deferred provider calls

[thymikee]

Summary

Follow up the SDK regression reported on #3828. Standalone APK package lookup now establishes its host before loading Android mechanics, so a manifest parse miss reaches aapt instead of silently caching its absence.

Centralize default capture for Android ADB, artifacts, Limrun, Metro, and remote-config in src/sdk/host.ts. Tighten R86 to that owner and document the entry boundary for #3753, pending #3759.

The requested adapter audit also found deferred Limrun ZIP and plist calls losing their supplied host. Scope those callbacks to that host, including concurrent calls inside a foreign scope. Port reversal uses its injected executor; download has no ambient host reader.

12 files, 314 gross lines: production +70/-60, tests +161/-2, docs +7/-14.

Validation

• Base 507ef2376621d78aa76cf531bedc5abdf30e7a5a; head 57dfc7889b0f6d051b92d96a16389aaa39588a6f.
• Same isolated command on both: pnpm exec vitest run --project unit-core src/sdk/artifacts.test.ts src/sdk/limrun-host-scope.test.ts: base 3 failed, head 3 passed.
• pnpm check:affected --run --head 57dfc7889b0f6d051b92d96a16389aaa39588a6f: passed (36 checks, 386 affected tests). Receipt run-enSRYl: exactCommit=true, checkoutChanged=false; 25 skipped, 2 deduplicated.
• Built public artifacts entry: base returns undefined, head resolves the fallback package. Built shell/exec-out entries both read Android API 36 on Pixel_7_CI (emulator-5554).
• Independent review at head: no findings; the guidance finding was corrected before rebase review.
• CI owns coverage and device lanes. No remote Limrun or Windows live run; subprocess regression fixtures skip Windows.

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	5.45 MB	5.45 MB	+76 B
Package (unpacked)	5.45 MB	5.45 MB	+76 B
Package (download)	1.65 MB	1.65 MB	+47 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	38.9 ms	41.1 ms	+2.1 ms
CLI --help	77.8 ms	80.1 ms	+2.3 ms

[thymikee]

This PR is ready at 57dfc78. The scoping change reads correctly, and all 17 checks pass on that commit.

Not blocking, and you can take or leave these: resolveAaptPath in packages/platform-android/src/manifest.ts still catches the typed host_environment_unscoped refusal and caches null for the whole process, with the cache not keyed by host, so the poisoning the new test title names can still happen. The rule is that a host-dependent lookup must not cache a refusal or cross hosts, so let that reason propagate and key the cache by SDK root, which is fine as a follow-up. The edit to docs/agents/code-ownership.md also removes unrelated guidance (the routing line and the selectors, test-support and "read the owner" rules), so please restore it and keep only the new row and the three SDK-host sentences. In src/sdk/artifacts.test.ts the standalone and scoped calls share one SDK root, so a cache that leaks across hosts cannot fail the test; a scoped call with a host that has no build-tools, followed by one with build-tools, would cover it.

I did not run the new tests, so the regression checks come from reading the base code paths, and the emulator run of the built android-adb and artifacts entries is your report. I could not confirm that the daemon's request-scope host is the same object passed to limrunCandidate; if they differ, the Limrun ios and archive adapters would drop the request env in the daemon, which has low impact because simctl runs remotely and zip and plutil do not read DEVELOPER_DIR. No conflicts are known.

#3835 overlaps this PR fully, so before merge please land this one and close #3835 or reduce it to its separate extras.