Embed Private composer in the keyboard

[bglglzd]

Summary

• embeds the Private composer above the keyboard instead of opening a separate Activity
• routes on-screen keys, Unicode, emoji, and edit commands only to a bounded in-memory draft
• commits only persisted CB1: ciphertext to the host with one commitText() call
• keeps plaintext visible in the protected panel until the user clears or closes it
• adds contact selection, Vault unlock, transport mode, message size, clear, and close controls inside the IME
• scopes host publication to the exact InputBinding.connectionToken
• uses durable READY to COMMIT_UNCERTAIN handoff state and migrates legacy pending sends fail-safe
• disables learning, clipboard paths, gesture callbacks, and detailed input debug logs in Private mode
• fixes legacy composer/viewer insets and prepares CipherBoard 0.2.0

Verification

• python scripts/kotlin_style_check.py .
• python scripts/security_source_scan.py .
• app, crypto-core, pairing, and secure-storage unit tests
• app, crypto-core, pairing, and secure-storage release lint
• :app:assembleDebug
• AOSP API 36 connected tests: app 7/7, crypto-core 1/1
• final independent review found no new High or Medium findings after fixes

Residual Limitations

Android can route a physical keyboard directly to the host field, so Private
mode supports only CipherBoard's on-screen keys. Complete JVM/UI memory
zeroization is not guaranteed. Physical GrapheneOS validation remains required
before high-risk use.