arm64: flat guest mapping, audio, crash reporting, self-extracting data

The run of work that took the translated build from "boots" to "playable".

Engine:
- Flat guest mapping replaces the software MMU on aarch64 hosts. A 4 GiB
  PROT_NONE reservation lets a 32-bit guest address zero-extend safely, so
  tcg_out_qemu_ld/st short-circuit before tcg_out_tlb_read and the prologue
  materialises the base into X28. Measured 1.24x (51 vs 41 fps, interleaved
  A/B). Note the base must be set BEFORE UC_INIT - Unicorn inits lazily, and
  setting it after uc_open silently falls back to softmmu.
- num_get<char> facet implemented, which was the real cause of the crash after
  the prologue race; a full race is now playable end to end.
- Thread-stack free list + ReleaseThreadEngine, fixing the arena leak that
  showed up as a black screen when entering a race. kMaxGuestThreads 16 -> 64.
- Real ARM32 FMOD now runs in-engine via the Java FMODAudioDevice bridge, with
  a per-thread JNIEnv. Two of the three blockers were our own single-image-era
  guards.

Host/app:
- Native crash handler: async-signal-safe, decodes the host fault back to a
  guest address, writes a report file and nothing else. CrashReportActivity
  picks it up on the NEXT launch, zips it, and offers to share. No backend, no
  automatic upload.
- Game data ships inside the APK and self-extracts on first launch, so a tester
  installs one file and plays. Copy-to-.part-then-rename, with a free-space
  check up front.
- EGL context preserved across pause, fixing black textures on resume.
- Navigation bar hidden and re-hidden on focus gain; volume keys reported as
  system keys, checked before the loading-state gate.
- x86_64 added to abiFilters: the ARM32 guest runs under tcg/i386 with no
  houdini in the path. The flat mapping is aarch64-only, so that host falls
  back to the software MMU - commented at the abiFilters line.

Ignore rules added for app/translated/ (611 MB of signed release APK, which
also carries the bundled OBB) and ostream_repro/build/.

Co-Authored-By: Claude <noreply@anthropic.com>

app/src/main/AndroidManifest.xml

@@ -26,6 +26,7 @@
 
     <uses-configuration android:reqTouchScreen="finger"/>
     <application
+        android:name="nfs.mod.traceagent.TraceApplication"
         android:theme="@style/Theme.AppCompat.NoActionBar"
         android:label="@string/app_name"
         android:icon="@mipmap/adaptive_icon"
@@ -48,6 +49,34 @@
                 android:value="bar"/>
         </activity>
 
+        <!-- One-time unpack of the game data bundled in the APK. -->
+        <activity
+            android:name="com.ea.ironmonkey.GameDataUnpackActivity"
+            android:exported="false"
+            android:excludeFromRecents="true"
+            android:label="Подготовка данных" />
+
+        <!-- Shown on the launch after a crash, never during one - a signal
+             handler cannot start an Activity (see crash_handler.cpp). -->
+        <activity
+            android:name="com.ea.ironmonkey.CrashReportActivity"
+            android:exported="false"
+            android:excludeFromRecents="true"
+            android:label="Crash report" />
+
+        <!-- Lets the tester share the zip. Required: targetSdk 35 rejects
+             file:// URIs in ACTION_SEND. Grants access to the crash directory
+             only, and only for the duration of the send. -->
+        <provider
+            android:name="androidx.core.content.FileProvider"
+            android:authorities="${applicationId}.crashreports"
+            android:exported="false"
+            android:grantUriPermissions="true">
+            <meta-data
+                android:name="android.support.FILE_PROVIDER_PATHS"
+                android:resource="@xml/crash_report_paths" />
+        </provider>
+
         <activity
             android:exported="true"
             android:name="com.ea.ironmonkey.PermissionsActivity"