arm64: flat guest mapping, audio, crash reporting, self-extracting data

The run of work that took the translated build from "boots" to "playable".

Engine:
- Flat guest mapping replaces the software MMU on aarch64 hosts. A 4 GiB
  PROT_NONE reservation lets a 32-bit guest address zero-extend safely, so
  tcg_out_qemu_ld/st short-circuit before tcg_out_tlb_read and the prologue
  materialises the base into X28. Measured 1.24x (51 vs 41 fps, interleaved
  A/B). Note the base must be set BEFORE UC_INIT - Unicorn inits lazily, and
  setting it after uc_open silently falls back to softmmu.
- num_get<char> facet implemented, which was the real cause of the crash after
  the prologue race; a full race is now playable end to end.
- Thread-stack free list + ReleaseThreadEngine, fixing the arena leak that
  showed up as a black screen when entering a race. kMaxGuestThreads 16 -> 64.
- Real ARM32 FMOD now runs in-engine via the Java FMODAudioDevice bridge, with
  a per-thread JNIEnv. Two of the three blockers were our own single-image-era
  guards.

Host/app:
- Native crash handler: async-signal-safe, decodes the host fault back to a
  guest address, writes a report file and nothing else. CrashReportActivity
  picks it up on the NEXT launch, zips it, and offers to share. No backend, no
  automatic upload.
- Game data ships inside the APK and self-extracts on first launch, so a tester
  installs one file and plays. Copy-to-.part-then-rename, with a free-space
  check up front.
- EGL context preserved across pause, fixing black textures on resume.
- Navigation bar hidden and re-hidden on focus gain; volume keys reported as
  system keys, checked before the loading-state gate.
- x86_64 added to abiFilters: the ARM32 guest runs under tcg/i386 with no
  houdini in the path. The flat mapping is aarch64-only, so that host falls
  back to the software MMU - commented at the abiFilters line.

Ignore rules added for app/translated/ (611 MB of signed release APK, which
also carries the bundled OBB) and ostream_repro/build/.

Co-Authored-By: Claude <noreply@anthropic.com>

app/src/main/jniLibs/armeabi-v7a/wrap.sh

@@ -0,0 +1,16 @@
+#!/system/bin/sh
+# APK-bundled wrap.sh (2026-09-16, ARM64_TRANSLATION_LAYER.md - trace_agent
+# LD_PRELOAD deployment investigation). The loose-file mechanism
+# (/data/local/tmp/wrap.<packageName>) was confirmed NOT invoked by zygote
+# on this specific Galaxy A9/Samsung build - a canary marker file placed by
+# that script never got created across multiple relaunches, root and
+# non-root, SELinux Enforcing and an attempted Permissive switch. This is
+# the OTHER officially documented NDK mechanism (developer.android.com/ndk/
+# guides/wrap-script): a wrap.sh bundled alongside the app's own native
+# libraries, picked up automatically for a debuggable app. Points LD_PRELOAD
+# at the app's own private files dir (not this APK-bundled location) so the
+# actual libtrace_agent.so can still be updated by just `run-as`-copying a
+# freshly-built one in, without needing to reinstall the whole APK each
+# iteration.
+export LD_PRELOAD=/data/data/com.ea.games.nfs13_arm/files/libtrace_agent.so
+exec "$@"