Fix reconnect reliability and harden production security

[daredoole]

What changed

• Make peer reconnect identity-aware so the service recovers automatically after peer restarts, IP changes, and stale endpoint state.
• Remove long-lived plaintext compatibility keys from memory and cleanse derived OpenSSL key material.
• Add parser fuzzing plus deterministic fuzz-smoke coverage for clipboard and protocol inputs.
• Add CodeQL, OpenSSF Scorecard, Dependabot, immutable Action/container pins, and CI policy tests.
• Harden the systemd user service and Android network/security defaults.
• Add signed-APK release enforcement, provenance metadata, and an explicit production security standard.

Why

The client needed to recover from normal network/peer churn without manual intervention, while its build, test, release, and runtime controls needed a defensible production baseline.

Security boundary

The PowerToys compatibility protocol is legacy AES-256-CBC and does not provide authenticated integrity. This PR therefore documents and enforces a trusted-LAN/private-VPN deployment boundary; it does not claim the compatibility transport is safe on an arbitrary hostile network. The native Android relay uses AES-256-GCM with directional keys and ordered sequences.

Validation

• Clean Release build: 22/22 CTest tests passed
• Clean ASan/UBSan build: 22/22 CTest tests passed
• Android release build, unit tests, and lint passed
• Real Clang/libFuzzer campaign: 189,419 executions, no crashes
• CI workflow pinning/policy, systemd hardening, shell/Python syntax, YAML/XML, and staged-diff checks passed
• Unsigned APK rejection verified

Operational impact

Operators should expose the service only to a trusted LAN or private VPN, keep the firewall allowlist narrow, and release only through the signed-artifact production gate documented in docs/production-security.md.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.