Fix OEM P2P bootstrap failures and release OpenADB 3.0.2

[communism420]

What changed

• replaces the Android run-as/private-file P2P bootstrap with a request-scoped abstract LocalServerSocket reached through a temporary local-only ADB forward;
• keeps bootstrap secrets and authenticated READY metadata in memory, restricts the exported service with android.permission.DUMP, and verifies the shell/root peer UID;
• adds an explicit ACCEPTED handshake, API 23–25 service startup fallback, bounded bootstrap reads, deterministic request-scoped cancellation, and exact forward cleanup;
• preserves SAF permission gating, authenticated LAN transfer, folder hierarchy, empty directories, parallel streams, and atomic file writes;
• bumps OpenADB and ACBridge to 3.0.2 / versionCode 30201, rebuilds signed APK aliases, release metadata, screenshots, documentation, and changelog.

Root cause and impact

Some OEM Android builds expose /data with mode 0755. AOSP run-as rejects that layout before ACBridge can start, producing run-as: /data readable or writable by others: 40755. The new bootstrap no longer depends on run-as or OEM /data permissions, so P2P can proceed to the existing SAF/LAN flow.

Validation

• Windows CI runs 29409867004 and 29410163669 passed the full CPython 3.10–3.14 matrix, Ruff, compileall, privacy/version/APK checks, offscreen GUI smoke, and all clean-process unittest shards.
• ACBridge 3.0.2 was rebuilt and verified for package/version metadata, ZIP alignment, v1/v2/v3 signatures, signer continuity, DUMP permission, and non-debuggable manifest.
• A disposable read-only API 36 emulator completed a two-session nested-folder upload: 3 files, 6 entries, 1,048,624 bytes, an empty directory, and matching SHA-256 hashes. Emulator NAT required a test-only data-port ADB forward.
• OpenADB-3.0.2.exe passed a clean-profile title/start/normal-close smoke and bundled Platform Tools/ACBridge archive inspection.

Remaining physical validation

No physical OEM Android 17 device or removable MicroSD/USB target was connected during this run. Direct-LAN speed/routing and the original handset firmware still require a physical confirmation.