Expose app container and file system access (get_app_container / adb pull)

[thymikee]

There is no way to push files into or pull files from an app's sandbox, or to inspect SQLite databases, UserDefaults/SharedPreferences, or keychain entries. Seeding test data or verifying persistence is not possible through agent-device. iOS has simctl get_app_container; Android has adb pull/push to app data paths.

Proposal: Add commands (or device-tooling docs) to:

• Path: Return the app container path (iOS) or app data path (Android) for the session app.
• Pull: Copy a file or directory from the app sandbox to the host (e.g. appdata pull <remote_path> [local_path]).
• Push: Copy a file from the host into the app sandbox (e.g. appdata push <local_path> <remote_path>).

Optionally document or provide helpers for common cases: e.g. pulling a SQLite DB, or (where possible) reading UserDefaults/SharedPreferences. Keychain access is more sensitive; document if any safe read-only introspection is possible.

Acceptance criteria:

• Command or documented way to get app container/data path for session app
• Pull file/dir from app sandbox to host
• Push file from host to app sandbox
• Docs and skill updated; note any keychain/secure storage limitations