feat(remote-config): strictly admit durable snapshot envelopes

[shameondev]

Stacked on #860.

Adds the internal Android wire boundary for Remote Config v2 snapshots:

• validates exact canonical response bytes and strong SHA-256 ETags;
• rejects duplicate/unknown fields, invalid UTF-8, non-portable JSON, scope mismatches, and all size-limit violations;
• atomically admits a complete release into Candidate with authoritative tombstones;
• persists transport evidence and integrity-bound Candidate/Active/Previous state;
• fences stale, foreign-core, A-B-A, identity-switch, and callback-delivery races.

No public network API is exposed in this increment.

Verification:

• 318 debug unit tests
• 318 release unit tests
• detektAll
• sdk assemble
• independent callback-race review: CLEAN

[shameondev]

Консолидировано в release-train PR (один PR на репозиторий). Ветка сохранена.