[jwatte]

Android 17 blocks local network connections for apps targeting API 37 until they declare and receive ACCESS_LOCAL_NETWORK. The companion previously started pairing and restored sessions without requesting that permission.

Add the manifest permission and gate connection setup behind the Android 17 runtime grant. Keep incoming pairing intents pending until access is allowed, provide retry and Android settings controls after denial, and recheck permission when returning to the app. Older Android versions continue directly to the connection UI.

Validation:

• ./gradlew ktlintFormat build ktlintCheck detekt test :app:assembleDebug passed; 466 unit tests, zero failures or skips.
• New tests cover older Android and Android 17 denial, grant, and revocation.
• Debug APK signature, alignment, and merged manifest checks passed.
• Uninstalled/reinstalled on a Pixel 11 Pro Fold running Android 17; the installed APK checksum matches the build.
• Verified authenticated access to the Mac's live workspace and agent data over Wi-Fi, with no adb reverse mappings. Revoking permission showed the access gate; granting it restored connectivity.

The physical denial dialog was not independently completed. Emulator UI tests and older physical Android devices were not tested.