Document how to drive the app on a device without popups

[kasnder]

Independent of the #704 stack — docs only, no code.

Why

Agent sessions kept burning turns tapping through onboarding, the VPN consent dialog and the runtime permission prompts, then landing back in onboarding after overwriting the preferences file (which drops onboarding_version). None of that is necessary.

What

A new subsection under §3's Connected-device testing, covering the adb-only setup:

• adb install -r -g for runtime permissions — with the caveat that -g grants the permission you are testing too, so revoke it explicitly or checkSelfPermission will lie.
• adb shell appops set <pkg> ACTIVATE_VPN allow, which makes VpnService.prepare() return null. That skips both the system ConfirmDialog and TrackerControl's own explainer in front of it.
• Seeding onboarding_version, which run-as can write before the first launch.

Plus the traps behind most of the churn:

• force-stop before editing preferences, or the running process overwrites your file on exit;
• merge rather than replace, so onboarding_version survives;
• adb uninstall / pm clear wipe the seeded prefs, the appop and the grants together.

And two things that matter on someone's personal device:

• VpnService.prepare() revokes whatever VPN app currently holds consent — the maintainer's own build, or their real VPN. Worth saying out loud before enabling a tunnel.
• Read notifications with dumpsys notification --noredact rather than screenshotting the shade, which captures the user's private notifications.

Two standing rules changed

Connected-device testing now defaults to fdroid debug. github debug installs as net.kollnig.missioncontrol.test — the same package as a maintainer's day-to-day dev build. The old advice meant testing on top of their real configuration, and enabling that build's VPN takes the consent slot from whatever they were running. The flavours differ only in the update-check API, so net.kollnig.missioncontrol.fdroid.test costs nothing and installs alongside. github remains the flavour for building and compile checks; only device work moves.

Destroying state now requires asking. The previous wording said not to uninstall or pm clear "unless the user explicitly requests a clean install"; it now states the rule directly and extends it to overwriting preferences and revoking permissions, and to targets that look like a throwaway you installed yourself — that case is one mistaken package name away from the real install.

Both changes come from a live session where I got this wrong: I uninstalled a debug build repeatedly for cleanup without asking, and revoked the maintainer's VPN consent without warning first.

Testing

Verified verbatim on a Pixel 8 (Android 17), from a clean install of the fdroid debug build: the app lands directly on ActivityMain, the VPN switch brings the tunnel up with no dialogs at all, and the permission under test stays denied.