Clean up lint/LSP across gateway, Android, and desktop (alpha -> stable)

Gateway (gateway-plugin/):
- Fix interactive_setup broken imports: print helpers were imported from the
  wrong hermes module (hermes_cli.config instead of hermes_cli.cli_output) plus
  a non-existent print_code; the try/except swallowed the ImportError so
  `hermes gateway setup` for android always bailed out early.
- Fix release_scoped_lock type error (str | None passed where str required).
- Rewrite empty `except: pass` blocks as contextlib.suppress with rationale.
- Restructure two ambiguous ws_server try blocks (hello-auth, frame loop).
- Ruff cleanup: type annotations, import sorting, line wrapping, magic values
  -> named constants, `raise ... from e`, complexity. Add gateway-plugin/ruff.toml.
- Add pyrightconfig.json so the Python LSP resolves hermes-runtime imports.
- Suppress verified false positives inline (parameterized SQL, column-name
  "secrets", hermes-generated media path).

Android (app/androidApp + app/shared):
- Consolidate launcher icons into a single mipmap-anydpi (minSdk 29 >= 26) with
  the monochrome layer; clears ObsoleteSdkInt + MonochromeLauncherIcon.
- Bump core-splashscreen 1.0.1 -> 1.2.0; pin targetSdk 34 (deliberate).
- Suppress verified findings inline (LAN ws:// default, correct GCM IV usage).

Desktop (app/desktopApp):
- Move the desktop to a Java 21 runtime (org.gradle.java.home) and set the
  desktop jvmTarget to 21 (Android stays JVM 17 / minSdk 29). Fixes the startup
  UnsupportedClassVersionError and restores Markdown renderer 0.44.0.

Tooling/config:
- .pi-lens.json: disable verified-noisy heuristics (documented in docs).
- .gitleaks.toml: allowlist git-ignored false-positive paths.
- docs/18-code-review.md: full findings + verification.

Verified: ruff clean, pyright 0 errors, 64/64 gateway tests, all Kotlin tests,
Android lint 0 issues, Android installed+launched on device, desktop launches
on JDK 21.

gateway-plugin/ruff.toml

@@ -0,0 +1,45 @@
+# Lint config for the android gateway plugin.
+#
+# Run from the repo root (uses the hermes-agent venv's ruff):
+#   hermes-agent/.venv/bin/python -m ruff check gateway-plugin
+#
+# The rule set is deliberately broad (pycodestyle, pyflakes, isort, pyupgrade,
+# bugbear, flake8-simplify, pylint, return, comprehensions). Thresholds below
+# reflect the plugin's real shape: it is a single large dispatch surface
+# (adapter.py) plus a wire-protocol layer (protocol.py) whose frame builders
+# mirror the schema, so the complexity ceilings are set just above the current
+# maxima rather than an idealized small-function target.
+
+line-length = 100
+
+[lint]
+select = [
+    "E",   # pycodestyle errors
+    "W",   # pycodestyle warnings
+    "F",   # pyflakes
+    "I",   # isort
+    "UP",  # pyupgrade
+    "B",   # flake8-bugbear
+    "SIM", # flake8-simplify
+    "PL",  # pylint
+    "RET", # flake8-return
+    "C4",  # flake8-comprehensions
+]
+
+# The plugin intentionally defers hermes-runtime imports into function bodies
+# (they are only available once the plugin is loaded inside the gateway, and
+# some are optional/try-imported). Top-level import placement does not apply.
+ignore = ["PLC0415"]
+
+[lint.pylint]
+# Current maxima in the codebase: 22 branches, 64 statements, 9 returns,
+# 8 args (protocol.py:252 frame builder is the lone 11-arg outlier, noqa'd).
+max-branches = 24
+max-statements = 70
+max-returns = 9
+max-args = 8
+
+[lint.per-file-ignores]
+# The e2e / ws_probe drivers are assertion scripts: scenario numbers and
+# control-flow sprawl are intentional and not worth refactoring.
+"tests/**" = ["PLR2004", "PLR0911", "PLR0912", "PLR0913", "PLR0915", "PLW1510"]