Market-leading AdAway quality hardening

[stevesolun]

Summary

• Hardens release/legal gates, direct APK updater build split, and signed-update/release documentation.
• Fixes generation-aware runtime truth, root export/runtime sync correctness, Subscribe-All cancellation behavior, and update pipeline verification coverage.
• Simplifies the product surface by removing dormant AI code, tightening Home/Discover/My Lists flows, preserving the AdAway bird branding, and recording fresh regression evidence.

Verification

• ./gradlew.bat --no-daemon --no-build-cache :app:testDebugUnitTest :app:assembleDebug :app:compileDebugAndroidTestJavaWithJavac --dependency-verification=strict --stacktrace passed at current HEAD.
• Clean proof worktree at d7f5c729 passed unit/build, connected runtime gates, Subscribe-All connected tests, UX matrix, license boundary, and diff hygiene; details are recorded in tasks/todo.md continuation 98.
• Connected runtime gates covered generation failure preservation, HTTP conditional updates, domain checker runtime truth, migrations, scheduled update work, VPN cache invalidation, and Subscribe-All cancellation.

Remaining Blockers

• Signed release/SBOM/provenance proof needs release signing and update-manifest secrets.
• Physical-device smoke needs a real Android device.
• MIT relicensing remains blocked until GPL-derived material is removed, rewritten, permission-cleared, and legally reviewed.

Review Notes

• Draft PR because release-secret and physical-device gates are still external blockers.
• The branch intentionally keeps task/evidence ledger updates for auditability.