M0: toolchain, monorepo scaffold, gateway plugin skeleton, CMP app

- gateway-plugin/: android platform plugin (plugin.yaml + adapter.py
  register(ctx) + no-op AndroidAdapter) + stub modules for M1-M5
- app/: Compose Multiplatform project (shared KMP + androidApp +
  desktopApp) with Gradle wrapper; builds :androidApp:assembleDebug
  and :desktopApp:compileKotlin
- scripts/guard_hermes_agent.sh + pre-commit hook: fail if hermes-agent/
  is staged (read-only reference, never committed)
- .gitignore excludes hermes-agent/; docs/ reference library

gateway-plugin/media.py

@@ -0,0 +1,16 @@
+"""Inbound media cache + outbound chunked streaming.
+
+Inbound: ``media.upload`` (chunked binary frames) -> ``cache_*_from_bytes``
+-> a ``media_ref`` the adapter attaches to the ``MessageEvent``. Enforces
+size limit + sha256 + MIME re-sniff.
+
+Outbound: ``send_*`` -> stage the file in the media cache, mint a
+``media_id``, emit ``media.offer {media_id, mime, size, filename, kind}``;
+serve bytes on ``media.pull`` as chunked binary frames. Delivery-path
+security via ``validate_media_delivery_path``.
+
+Reuses hermes ``cache_image/audio/video/document_from_bytes`` where possible.
+All paths under ``get_hermes_home()/"android"/media``.
+
+Milestone M4.
+"""