feat(android): make the JADX operation deadline configurable (#4466)

* feat(android): make the JADX operation deadline configurable

JADX operations used a fixed 120 s provider deadline and a separate fixed
120 s per-call bound in the session, so an APK whose cold load exceeds
120 s could not complete, and raising only the MCP client timeout could
not extend either. Add REA_JADX_OPERATION_TIMEOUT_MS, parsed once by the
JADX configuration owner (decimal milliseconds from 1 to 2147483647,
default 120000). The provider resolves it before acquiring anything and
uses it for the operation deadline and its timeout errors, and the session
uses it for every upstream call. Doctor reports the effective value, and
setup forwards an explicit value like the other JADX settings.

Fixes #3918

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test(android): isolate JADX fixtures from inherited shell settings

The shared JADX protocol fixture spread the developer's process.env, so an
exported REA_JADX_OPERATION_TIMEOUT_MS (or REA_JADX_HEAP_MIB) changed every
provider test that never selected one. Keep inheriting the host environment
for process launch, but take REA_JADX_* settings only from the fixture.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

docs/android-analysis.md

@@ -300,8 +300,25 @@ down to MiB and retains exact bytes, Java version and visible processors in its
 raw runtime response. The observed allocatable heap can differ from configured
 `-Xmx`, especially with Serial GC. Heap is not a total RSS cap: the JVM also
 uses native memory. Independent REA instances have independent queues. Whole
-operations have a **120-second** execution deadline after reaching the queue's
-front; upstream decompilation is limited to **90 seconds**.
+operations have a **120-second** execution deadline by default, starting after
+they reach the queue's front. For a known slow cold load, such as a large
+multidex APK, select another finite deadline:
+
+```sh
+export REA_JADX_OPERATION_TIMEOUT_MS=600000
+```
+
+The value must be a decimal millisecond count from 1 to 2147483647; anything
+else is refused before Java starts. The same deadline bounds each upstream
+call, a timeout reports the selected value, and a passing JADX configuration
+check in `rea doctor` reports the effective `operation_timeout_ms`. Explicit
+cancellation still ends the operation immediately, and partial observations
+and owned-process cleanup are unchanged. Raising the deadline does not extend
+the bridge's 30-second startup handshake or the upstream **90-second**
+decompilation limit. MCP clients enforce their own tool-call timeouts, and
+setup's derived [client tool timeout](client-configuration.md) does not include
+this setting, so also raise the client timeout when selecting a longer
+deadline.
 
 Decoded manifest and method text have a **1 MiB** upstream byte budget and report
 truncation. Class-name pages use indexed slices of up to 4,096 names without changing the