feat(android): implement private Rust storage runtime (#90)

docs/android/mobile-contract.md

@@ -31,8 +31,10 @@ selected variants belong to the native UI. Actions already use typed enums.
 
 - `MobilePlatformPaths` accepts absolute private data and cache roots, rejects
   traversal and overlapping roots, and lets storage derive config/vault/key
-  paths. Validation does not create or migrate files. #90 owns initialization,
-  permissions, relocation, backup and cache policy.
+  paths. This lightweight validator does not create or migrate files. #90's
+  `MobilePrivateRuntime` opens the three canonical OS directory capabilities,
+  activates the shared configuration context, and owns initialization,
+  permissions, relocation, backup and cache policy; see [private storage](private-storage.md).
 - `MobileSecretBackend` performs create/retrieve/replace/delete/lock/unlock on
   a typed locator and protection supplied by storage. Values are opaque encoded
   storage records. OS errors are enums. It cannot select accounts, protection,