M0: toolchain, monorepo scaffold, gateway plugin skeleton, CMP app

- gateway-plugin/: android platform plugin (plugin.yaml + adapter.py
  register(ctx) + no-op AndroidAdapter) + stub modules for M1-M5
- app/: Compose Multiplatform project (shared KMP + androidApp +
  desktopApp) with Gradle wrapper; builds :androidApp:assembleDebug
  and :desktopApp:compileKotlin
- scripts/guard_hermes_agent.sh + pre-commit hook: fail if hermes-agent/
  is staged (read-only reference, never committed)
- .gitignore excludes hermes-agent/; docs/ reference library

gateway-plugin/pairing.py

@@ -0,0 +1,10 @@
+"""Pairing: token generation/verification + device registry.
+
+Token generation (64-hex) and constant-time verification. Device registry
+(SQLite) tracks ``device_id``, name, caps, fcm_token, ntfy_topic, last_seen,
+created. QR payload for the pairing flow (``interactive_setup``).
+
+Storage: ``get_hermes_home()/"android"/devices.db``.
+
+Milestone M1.
+"""