Fix the lifecycle, audio, and renderer issues from the full-app review

[jpcottin]

Same treatment as VulkanAsteroids #17: a whole-app review (game logic, renderer and glasses bridge, audio, tests, build, CI), everything actionable fixed, then a second review pass on the diff itself.

This port had already absorbed most of the Asteroids findings (focus pause, per-image semaphores, dt-scaled decay, death-frame gating, a real smoke assertion), so the list is shorter and skews toward failure paths.

Correctness

• RNG seed was undefined behaviour: uptime × 1e6 cast to uint32 overflows after ~72 minutes and saturated to a constant seed on AArch64, so every launch replayed the same drops and timings. Seeded from the clock's integer fields instead.
• Music: a process-death restore left music off (the audio engine arrives after the round starts), a settings reload never re-applied the sound toggle, and the new sync rule initially ignored the glasses handoff. One syncMusic() rule now covers all of it.
• Scoring after the table was written: the winning volley could still kill escorts after the boss; a tie with an existing row could duplicate it and is no longer flagged as a new record.
• Title reset: invulnerability and the boss were not cleared, so the title ship blinked forever and the mothership stayed drawn under Settings. Shared resetBattlefield() with startLevel().
• Renderer failure paths: a failed surface recreate left the next frame on a null surface; a half-built swapchain was trusted; a failed submit left a fence that would hang the next relaunch; DEVICE_LOST busy-looped. All now rebuild device state through a recovery timer with backoff, and preTransform is IDENTITY.
• Audio: error-callback reopen synchronised with shutdown and the implementation held by shared pointer; native sample rate; pause on focus loss; wrapping music phases; soft clip and lower explosion gains.
• JNI: local references leaked on every bridge call (the game thread never returns to Java); a failed lookup was retried every second.
• Atomic saves with fsync, scores drawn as long, draw-command vector reused, per-engine FPS counters.

Tests, build, CI

• Boss bomb test now asserts the bomb is aimed; win test asserts table equals final score; new tests for the title reset and the tie case.
• Gating jobs get timeouts; the one NDK install without pipefail gets it; Oboe pinned to a hashed tarball; -Wall -Wextra on both native targets (clean); runNativeTests finds the newest binary; backup rules wired; missing proguard file reference dropped; repo .clang-tidy.
• Replay script keeps the emulator process-group id while alive (KILL fallback) and no longer relaunches the app after run 1, matching the CI job it mirrors.

Behaviour changes worth knowing

• Oboe sharing mode is now Shared (was Exclusive).
• Audio pauses while the phone activity is unfocused.

Not changed

• GitHub Actions still pinned to major tags; the Android CLI installer is still fetched unpinned.

Verified

• 105 native tests pass on the MP36 AVD (arm64).
• On MP36: title, play at 60 fps, shade pause, Home + relaunch; no Vulkan or Oboe warnings in logcat; stream opens at 48 kHz.