GhostIDE v2.36.0 - batch 3 final: hardening rounds R3-R5

Batch 3 final release: v2.36.0 (versionCode 141)

APK: ghostide-v2.36.0.apk, 20,324,971 B
MD5: 9fdcddacaf4e8edcc5d3ff7062ddf8f7
SHA-256: 8022d3445f8b346269ad1d5de9769aaf78799179d1908987043c7e30e012c567
compileSdk/targetSdk 36, minSdk 24, same signing key as v2.31.0.
(APK asset not attached: the automation credential is scoped to api.github.com and uploads.github.com returns 401, same as v2.11.0/v2.31.0. The APK itself is delivered to the owner directly.)

Batch 3 closed the five-scout audit (pairing, backup/restore, Java HTTP, frontend injection, TLS design), shipped across v2.34.0 (R3, in the shared Beat Cline release), v2.35.0 and this release:

• Pair tokens expire 12 h after issue on both servers, with a loopback-only host revoke-all and a pair-panel action; the join limiter race is closed.
• Restore is journal-protected: a process kill mid-apply is rolled back at startup from a write-ahead journal in .ghostide-restore.
• Backup and restore count what they actually stream (directory entries included), duplicates are refused during the scan, free-space prechecks refuse up front when the disk cannot hold the result, and envelope fields are validated before the password KDF runs.
• HTTP parsing hardening on both servers: duplicate or non-numeric Content-Length and any Transfer-Encoding are hard refusals, truncated bodies are never routed, bare-LF header blocks parse, reads time out at 30 s, and the phone server caps concurrent connections at 32.
• Markdown preview stored-XSS closed: attribute values are quote-escaped at interpolation, link schemes are allowlisted (other schemes render as inert text), and both update-check URL uses require http(s).

Final gates on this tree (foreground): 65/65 harness files including the new markdown harness 12/12, DOM-stub clean, JVM BkTest 18 / ZgTest 14 / PcTest 6 / PhTest 14 / RsTest 25, probes hardening 19 / restore 41 / pair 36 / GH e2e 19, python eco E1 ALL PASS.

Still open by design: TLS for LAN pairing (design draft awaiting the owner's decisions), independent second-machine build reproduction, remaining IdeServer splits. Java socket-level behavior is compile- and parity-proven; on-device confirmation rides the next device pass.