Stealth PR1: randomize the Frida path off /data/local/tmp/

Summary

Move frida-server off the canonical /data/local/tmp/frida-server path — the single highest-value stealth change. The binary at that path is the first thing nearly every commercial RASP product checks (see the exposure inventory, risk: Critical).

The target is a per-build randomized path of the form /data/adb/modules/<random>/bin/<random> (two independent base32 segments ≥12 bytes), generated at beetroot create time and persisted in the registry.

Current status

The plumbing already shipped in v0.4 (PR6): BEETROOT_FRIDA_BIN is wired end-to-end through render_env, the bundled compose template, and the helper shells; the RedroidBackendConfig.stealth_paths registry slot + registry.set_stealth_paths + the snapshot/restore path_layout round-trip are all in place. The default container-side path is still /data/local/tmp/frida-server.

The actual default-flip is deferred pending stealth research (blocked by #2). Once a path is validated, this becomes a one-line change in Instance.create's stealth_paths generator.

Acceptance criteria

• Research prerequisite #2 resolved (blocking).
• Instance.create generates and persists a randomized Frida path in stealth_paths.
• BEETROOT_FRIDA_BIN defaults to the randomized path; launch-frida.sh already reads it.
• A /data/local/tmp/frida-server directory scan no longer finds Beetroot's Frida.
• Tests assert the resolved .env and snapshot path_layout carry the randomized path.

Complexity: S (once research is in).

Source: docs/design/stealth-posture.md §3.1 + §7 PR1.

Read docs/design/stealth-posture.md sections 3.1 and 7, then resolve the research prerequisite in blocking issue #2. Trace Instance.create and the existing stealth_paths, render_env, compose template, helper shells, and snapshot path_layout plumbing. Done means a persisted randomized path reaches BEETROOT_FRIDA_BIN, tests cover the .env and snapshot values, and the canonical directory scan does not find Beetroot's Frida.