fix(android): reject stale candidate callbacks for #253

[limeimetw]

Status

Draft diagnostic/fix slice for #253. Do not merge yet.

Verified root cause

A candidate database query can complete after Backspace clears the final composing code. Java thread interruption alone is not a validity guarantee because a backend/Binder call may still return. The obsolete callback then replaces the automatic Chinese-punctuation strip with stale candidates.

Changes

• make candidate-query worker ownership per LIMEService instance
• use one generation contract across candidate, related-phrase, and English prediction callbacks
• reject stale terminal UI/model mutations after clear, finish, or service teardown
• add deterministic instrumentation regressions for stale candidate and related callbacks, service ownership, teardown, and the empty-related commit path

Evidence

• RED: stale candidate result replaced the punctuation strip after final-code Backspace
• RED: delayed related result restored stale content after the cycle was dismissed
• RED: delayed callback mutated candidate state after service destruction
• GREEN: LIMEServiceTest 296/296 passed on Pixel 9 Pro API 36
• independent review: READY with no unresolved findings

Remaining validation

The synchronous pickCandidateManually() → empty related-query test passes, but that does not prove the reporter-visible Array 30 runtime path is resolved. The required Claude Code review remains blocked because its OAuth session could not authenticate and must succeed against the final exact PR head. Exact signed-build/device validation for both reported Array 30 transitions also remains required before marking #253 fixed or requesting merge. Keep the PR in draft until both gates pass.

Issue: #253