fix(android): expose permissions bridge for mobile runtime

Problem

The generated Android bridge exposes craft.location, but does not expose craft.permissions. As a result, @stacksjs/mobile permissions.check('location') and permissions.request('location') fall back to WebView geolocation, which reports denied even when Android location permissions have already been granted.

Reproduction

1. Build a Craft Android app with geolocation: true.
2. Add the shared STX <NativePermissionButton permission="location" />.
3. Launch with Android location permissions granted.
4. Tap the button.

The button remains denied and offers Settings. The same app can access the native craft.location bridge.

Expected

Expose craft.permissions.check, request, and openSettings from the Android bridge, or have the mobile runtime detect craft.location for location permission state. This lets shared STX permission controls use native Android permission state consistently.

Implemented in bb5c1b5 with the Android conformance ownership guard in bef28ac. Generated apps now expose craft.permissions.check, request, and openSettings with Activity callback routing and timeout handling. Verified through the Android builder tests, package build, full Zig/JS suite, and final head 7a16e82 where CI, SBOM, Binary Size, and Benchmark all succeeded.