XERK-281: silence the in-app updater in Android unit tests

[xerhab]

What & why

TurmaApplication.onCreate fires a fire-and-forget Updater.check() (the XERK-11 in-app updater), which fetches https://api.github.com/repos/…/releases. Robolectric rebuilds the Application per test METHOD, so the updater's ~15-minute throttle never applies and every test hits live api.github.com — measured 45 anonymous CONNECTs per :app:testDebugUnitTest run, from shared-IP CI runners, against GitHub's 60 req/hour/IP unauthenticated limit. It also showed up as an "Update available" banner in a Robolectric screen test. Filed by the QA pass on XERK-262 (PR #439); Low because the suite never depended on that egress, but unsolicited third-party traffic worth removing.

The fix — Option A (the ticket's preferred, smallest seam)

• net/Updater.kt — check() no-ops at its very top, before the throttle/force branch, when the turma.updater.disabled system property is "true". New const DISABLE_PROPERTY. Nothing in production sets it, so production behavior is unchanged (a real device's start-of-app check is untouched).
• app/build.gradle.kts — testOptions.unitTests.all { it.systemProperty("turma.updater.disabled", "true") } sets it for the whole test JVM.
• net/UpdaterTestSeamTest.kt — regression test pinning both halves: the property reaches the test JVM, and check(force=true) short-circuits under it. The no-op is asserted on lastCheckAt (0 iff check() never proceeded past its guards), not on state — a check that ran and whose fetch failed (offline/blackholed CI) also lands on Hidden, so a state assertion would be a tautology that passes with the guard removed. lastCheckAt is exposed @VisibleForTesting for this.
• .claude/rules/android.md — harness rule added so the egress is not reintroduced.

No user-facing surface changes → no android/PARITY.md or web-side change needed.

Verification (adversarial QA + delta, both ran the build)

• gradle :app:testDebugUnitTest — green, 450 tests / 0 failures; UpdaterTestSeamTest 2/2.
• Ticket's own repro (CONNECT-logging blackhole proxy via JAVA_TOOL_OPTIONS): api.github.com CONNECTs 45 → 0 with the fix.
• Mutation checks prove the test guards the seam, not just the wiring:
  • remove the it.systemProperty(...) gradle line → disablePropertyIsSetForTheTestJvm fails and 45 CONNECTs return;
  • remove the production guard in check() → checkNoOpsUnderTheDisableProperty fails on lastCheckAt (expected:<0> but was:<…>). (First QA pass caught that an earlier state-only assertion did not catch this; fixed and re-verified PASS.)
• Not verified: real device/emulator app-start egress (no emulator gate in this repo, per android.md) and the live fetchLatest I/O path (deliberately blackholed — the suite must not depend on egress). Both unchanged by this diff.