feat(roku): add Roku platform support - #3

Validated against a physical Roku Streaming Stick 4K (Roku OS 14). Three
fixes, each reproduced and verified on the device:

- launchApp is now a cold launch: ECP's /launch resumes an already-running
  channel with its state intact, so exit to the home screen first (Maestro's
  launchApp contract; matches VegaDriver's terminate-then-launch)
- Screenshot generation: the dev server's multipart parser silently ignores
  form parts carrying a per-part Content-Length header (which OkHttp's
  MultipartBody always adds) and also requires an empty 'archive' field —
  build the form body by hand and do the digest handshake explicitly with an
  empty-body probe, verifying the 'Screenshot ok' confirmation
- Screenshot download: poll /pkgs/dev.jpg's ETag against the pre-generation
  value (the capture file is written asynchronously) and cache-bust the URL,
  so a stale prior capture is never returned as the result

All three e2e demo-channel flows plus a screenshot flow pass against the
real device; roku unit tests pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Rebuild e2e/roku_demo_app to mirror the tvOS/Vega demo apps — same screens,
labels, and testIDs — and mirror all three flows:

- Home menu (menu-navigation / menu-text-input / menu-focus) opening one test
  screen at a time, with Back returning Home
- Navigation Test: 2x2 grid (grid-top-left/right/bottom-left/right) covering
  all four D-pad directions via an explicit focus-transition map
- Text Input Test: a native Keyboard node (text-field) focused on entry so
  inputText (ECP LIT_) and eraseText (Backspace) land in it directly, with a
  typed-label echoing the text
- Focus Test: programmatic focus (setFocus on entry) lands on focus-button-2

Driver fix shaken out by the text-input flow: ECP keypress path segments were
form-encoded, so a space became '+' and LIT_+ typed a literal plus — percent-
encode path segments instead ('Hello Roku' now types correctly).

Channel fix found on hardware: creating the hidden TextInputScreen's Keyboard
steals input focus after HomeScreen's init has claimed it, leaving D-pad keys
routed to the invisible keyboard — MainScene re-asserts the Home menu's focus
once all screens exist (focusDefault interface function).

All three mirrored flows pass against a physical Streaming Stick 4K; roku
unit tests (14) pass, including new coverage for the path-segment encoding
and the dev server's digest challenge.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Credit the Roku platform contribution to the Nami team (nami.ml / rku.dev)
in the README feature list and the FORK.md platform entry.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Addresses the Medium findings in the plexinc#3 review.

- Remove the RTA_LAUNCH=1 launch parameter. Nothing in the fork reads it; on a
  roku-test-automation channel it asks for no restart, which is exactly what the
  exit-to-Home cold launch exists to force; and on any other channel it is an
  uninvited parameter riding along with the flow's own openLink deep link.
  launchChannel now sends only the caller's parameters, and omits the query
  string entirely when there are none.
- Invert swipe directions. A swipe names where the content goes, so on a
  focus-driven UI every direction flips: swipe(UP) reveals what is below and
  therefore presses Down. Roku had swipe(UP) pressing Up, inverted relative to
  VegaDriver (where scrollVertical() *is* swipe(UP)) and to web (where swiping
  up increases scrollY). The mapping now lives in RokuKeyMapping so a unit test
  can lock it without hardware, the coordinate overload converts its delta to a
  SwipeDirection and delegates, and scrollVertical() is swipe(UP) as on Vega —
  emitting the same five Down presses it always did.
- Harden the XML parser: FEATURE_SECURE_PROCESSING, disallow-doctype-decl, no
  external entities, no XInclude, on network-sourced XML. DocumentBuilderFactory
  is not thread-safe for newDocumentBuilder() and the driver polls the hierarchy
  off more than one thread, so builder creation moved under a lock.

Roku unit tests 20 -> 25.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Addresses the Low findings and the fork-conventions note in the
plexinc#3 review.

- parseArray takes a minSize and returns null below it (2 for translation, 4 for
  bounds), so the positional reads can't run off a short array; the downstream
  `bounds.size >= 4` guard collapses into the null check, putting the arity rule
  in one place. Its NumberFormatException catch also returned null as the
  expression value rather than from the function.
- close() evicts both connection pools, not just the dispatchers.
- The digest nonce count restarts at 1 for each new server nonce, per RFC 2617,
  instead of climbing for the client's lifetime.
- deviceInfo() caches the result of its retry. contentDescriptor reads that field
  on every hierarchy dump, so an uncached fallback cost an extra ECP round trip
  per command.
- The parser reports the subtype attribute the device sent, falling back to the
  element name and to Group only for a bare RenderableNode.
- roku-text-input-flow erases an explicit 12 characters: every one is a separate
  ECP Backspace keypress, so the default of 50 spent ~5s clearing 10 characters.
- Add the Roku row to the update-from-upstream fork-commit table, which
  verify-fork-stack reconciles against the stack one-to-one.

Roku unit tests 25 -> 27.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>