Allow explicit scanner use in production builds

[rtsketo]

Summary

• add toggleScanner(enabled) for trusted non-debuggable builds
• enforce main-thread lifecycle transitions
• route global APIs across multi-resume automatic activities with manual-install fallback
• prevent queued resume callbacks from reversing explicit uninstall
• clean lifecycle observers on detach and preserve manual uninstall semantics
• document safe trusted trigger gating and source-set placement
• add regression tests for automatic, manual, multi-resume, race, and routing behavior

Validation

• :scanner-ui:test
• :scanner-ui:lint
• :sample:assembleRelease
• git diff --check

[rtsketo]

Follow-up fixes are pushed at 054e55c. This head restores manual-install routing, preserves surviving manual scanners, blocks queued resume callbacks after uninstall, gates trusted triggers in the documentation, and adds regression coverage. Validation passed: :scanner-ui:test, :scanner-ui:lint, :sample:assembleRelease, and git diff --check. Please re-review the latest head.

[mohdaquib]

Re-reviewed the latest PR head (63f521f). The manual-install fallback and queued-resume/uninstall race identified in the earlier review are now addressed by selectEntry() and the pending/suppressed lifecycle state.

Two remaining recommendations:

1. Medium — make trusted-build gating fail closed. The README example endpoint != PROD enables the scanner for unknown, uninitialized, or newly introduced endpoint values. Since this path ships scanner code in a non-debuggable app, prefer a positive allowlist (for example, an internal build flavor and an explicitly trusted endpoint). Where possible, recommend internalImplementation / src/internal instead of broad implementation / src/main placement.

2. Test coverage — add integration coverage around the helper. The new unit tests validate ScannerLifecycle and selectEntry() in isolation, but an Activity/Robolectric or instrumentation test should verify that a posted resume cannot recreate a detached overlay and that manual install() remains the target of triggerScan() / notifyScreenChanged() after automatic entries pause or are removed.

[rtsketo]

Final two Medium findings are fixed at fd33739: repeated manual install is again a true no-op, and built-in long-press/shake callbacks atomically no-op when scanner permission has been disabled. Tests, lint, release assembly, and diff checks pass. Please review the latest head.

[mohdaquib]

Follow-up on the latest head (fd33739): the repeated-install routing fix and the new disabled-trigger no-op behavior look valid. Two earlier review requests remain unresolved:

1. Medium — use fail-closed trusted-build gating. README.md still shows toggleScanner(enabled = endpoint != PROD). Unknown, uninitialized, or newly added endpoint values therefore enable the scanner. Please use a positive allowlist and prefer an internal flavor/source set, for example internalImplementation with src/internal, rather than broadly recommending implementation / src/main.

2. Test coverage — add integration-level lifecycle/routing coverage. The existing tests exercise ScannerLifecycle and selectEntry() in isolation, but do not verify the actual Activity/overlay/controller wiring. Please cover queued resume after explicit uninstall, manual routing through triggerScan() / notifyScreenChanged(), automatic-to-manual fallback, and detach cleanup. The latest commit also needs regression tests proving repeated install() does not steal active routing and default long-press/shake triggers quietly no-op after disable or before installation.