Implement Rust-owned Android local and HTTPS onboarding (#95)

android/README.md

@@ -1,10 +1,10 @@
 # Native Android build
 
 Architecture and issue ownership: [ADR](../docs/android/architecture.md) and
-[parity matrix](../docs/android/parity.md). The native foundation implements #89–#94, including private storage, Keystore
+[parity matrix](../docs/android/parity.md). The native foundation and onboarding implement #89–#95, including private storage, Keystore
 callbacks and build gates. Both variants invoke Rust through the generated
-UniFFI API. Onboarding and the feature screens remain owned by their milestone
-issues. The full [CI and emulator workflow](../docs/android/ci.md) documents the
+UniFFI API. Local-first and HTTPS onboarding is described in
+[onboarding](../docs/android/onboarding.md); feature screens remain owned by their milestone issues. The full [CI and emulator workflow](../docs/android/ci.md) documents the
 ARM-only runner/toolchain policy and artifact audits.
 
 ## Reproducible setup
@@ -54,8 +54,9 @@ code cannot conceal a domain implementation.
 
 Debug controls invoke the storage-owned MobileShell::fixture through the native
 API for Loading/Empty/Ready/Locked/Error. A build-generated fixture inventory is
-used only as the test oracle. Release calls the same Rust Empty fixture without
-debug controls; repository initialization is owned by #90. Feature code consumes
+used only as the test oracle. Release loads the real Rust private-storage state without debug controls.
+An unconfigured runtime opens staged onboarding; Preferences can add HTTPS
+synchronization or replace its protected token. Feature code consumes
 only the facade, including typed native recovery states.
 
 ## Identity, signing and update