feat(remote-config): add resilient fetch policy

[shameondev]

Summary

Adds the internal/dark Android Remote Config fetch coordinator on top of #861. It does not add a public endpoint, caller-supplied user_id, or identity-session protocol.

• concurrent request coalescing and configurable minimum interval
• optional timeout returns best Active/bundle while the network request continues
• persisted capped exponential backoff with full jitter and normalized Retry-After precedence
• build/identify/logout force triggers without bypassing incident backoff
• exact current-head ETag/304 contract and one unconditional retry when local canonical bytes are missing or stale
• identity/scope/admission fencing for late responses

Reliability review fixes

Independent adversarial review found and this PR fixes:

• orphaned transport requests permanently absorbing future fetches
• callbacks executed under locks / lost after reentrant identity transition
• 304 validating a Previous rather than current head
• silent policy persistence failure causing restart stampedes
• fail-open jitter/deadline handling

Late orphan responses are fenced but the underlying HTTP operation is not cancelled, matching the client timeout contract. Backoff is scoped by project+environment so an identity change cannot bypass a 429/5xx incident budget.

Verification

• independent re-review: CLEAN
• focused fetch/store/core tests: 24/24
• full debug unit tests: 342, zero failures/errors
• full author gate: :sdk:test detektAll :sdk:assemble, 80 tasks, debug+release, green
• detekt: zero findings
• git diff --check

Deliberate boundaries

Transport receives an already normalized retryAfterMillis; raw HTTP Retry-After parsing belongs to the future HTTP adapter. Public fetch stays closed until project/environment/canonical identity are bound by the opaque identity-session foundation and signed identity assertion.

[shameondev]

Консолидировано в release-train PR (один PR на репозиторий). Ветка сохранена.