M0: toolchain, monorepo scaffold, gateway plugin skeleton, CMP app

- gateway-plugin/: android platform plugin (plugin.yaml + adapter.py
  register(ctx) + no-op AndroidAdapter) + stub modules for M1-M5
- app/: Compose Multiplatform project (shared KMP + androidApp +
  desktopApp) with Gradle wrapper; builds :androidApp:assembleDebug
  and :desktopApp:compileKotlin
- scripts/guard_hermes_agent.sh + pre-commit hook: fail if hermes-agent/
  is staged (read-only reference, never committed)
- .gitignore excludes hermes-agent/; docs/ reference library

gateway-plugin/push.py

@@ -0,0 +1,15 @@
+"""Push backends: FCM (primary) + ntfy (fallback).
+
+``PushBackend`` interface with two implementations:
+  - ``FcmBackend``: FCM HTTP v1 via ``httpx`` + a Firebase service account
+    (``ANDROID_FCM_SERVICE_ACCOUNT``), or a legacy server key
+    (``ANDROID_FCM_SERVER_KEY``).
+  - ``NtfyBackend``: reuses hermes ntfy publish (``NTFY_TOPIC`` /
+    ``NTFY_SERVER_URL``).
+
+Selected by ``ANDROID_PUSH_BACKEND`` (``fcm`` default, ``ntfy`` fallback).
+Fired when a frame has no live subscriber; data payload drives a silent sync
+on the device.
+
+Milestone M5.
+"""