Per-system bundles, and Android's start problem closed by narrowing it

Two gaps.

The bundle's contents are per system even though its mechanism is not, so there
are now three: substrate-arch.lock, substrate-alpine.lock and
substrate-android.lock. All three are embedded and a host reads only the one it
was built for. Arch and Alpine remain placeholders -- the closure for a one-node
mesh is still research 011/012's open question, and inventing it here would be
worse than an honest placeholder.

Android's is not a placeholder. It says a partial host cannot raise a mesh and
why: every step of a bootstrap is a package, a container, or an action against
one, and those are exactly the shapes it refuses. So a partial host can JOIN a
mesh and cannot BE the first node. That belongs where somebody looking for the
android bundle will find it.

Also separated two things that were being conflated: "this system has no
bundle" and "this system was never built". Loading a bundle for debian is not
ErrEmpty, and the test asserts they differ.

0062 -- a host may be episodic. There is no way to keep a process running on an
ordinary Android device: init needs root, a foreground service can be killed
for memory. The answer is not to fight that. It is that being killed IS
disconnection, which ADR 0036 already made an ordinary situation -- and
everything the design does for a laptop that closes is what an episodic host
needs, at a shorter period. An authoritative local store, reconcile on start,
last-heard-from reported without an alarm.

So the gap closes by requiring less rather than building something. No keep-
alive, no Android daemon, no fighting the platform's process management.

Two consequences recorded rather than glossed. Last-heard-from is a much weaker
signal on an episodic host, so a healthy phone reads as a dead server unless
the reader knows which kind it is looking at. And a declaration may take a long
time to land, which makes 0058's separation of outstanding from failed
load-bearing rather than tidy.

Left open deliberately: how an episodic host is actually started, and -- first --
what an Android node is for. Building the start mechanism before deciding that
would be building it for nobody.

internal/bundle/bundle_test.go

@@ -15,10 +15,10 @@ func TestADefaultBuildCarriesNothingAndSaysSo(t *testing.T) {
 	// The important one. A host built without a bundle that applied nothing and reported
 	// success would look exactly like a host that raised a first node — and the difference
 	// would surface as a mesh that never came up, with nothing to point at.
-	if !IsEmpty() {
+	if !IsEmpty("arch") {
 		t.Fatal("the default build claims to carry a substrate")
 	}
-	_, err := Load()
+	_, err := Load("arch")
 	if !errors.Is(err, ErrEmpty) {
 		t.Fatalf("an empty bundle did not refuse: %v", err)
 	}
@@ -80,3 +80,34 @@ func TestWhatValidatesIsWhatIsApplied(t *testing.T) {
 func parseFor(raw []byte) (any, error) {
 	return declarationParse(stripComments(raw))
 }
+
+func TestEverySystemHasABundleAndAndroidsRefuses(t *testing.T) {
+	// The bundle's contents are per system even though its mechanism is not (novox/hq ADR
+	// 0060), so a host must find one built for it — and a host built for a system with no
+	// bundle at all must say that rather than behave like an empty one.
+	for _, system := range []string{"arch", "alpine", "android"} {
+		if _, err := Load(system); err == nil {
+			t.Errorf("%s: a placeholder bundle loaded as if it had contents", system)
+		} else if !errors.Is(err, ErrEmpty) {
+			t.Errorf("%s: refused for the wrong reason: %v", system, err)
+		}
+	}
+
+	if _, err := Load("debian"); err == nil {
+		t.Error("a bundle was loaded for a system nobody has built")
+	} else if errors.Is(err, ErrEmpty) {
+		t.Error("an unbuilt system was reported as an empty bundle; those are different things")
+	}
+}
+
+func TestAndroidsBundleSaysWhyThereIsNone(t *testing.T) {
+	// Not a placeholder waiting to be filled in. An android host implements neither `package`
+	// nor `container` nor `service`, so every step of the bootstrap is a shape it does not
+	// have — a partial host can JOIN a mesh and cannot BE the first node.
+	text := string(Raw("android"))
+	for _, want := range []string{"cannot raise a mesh", "JOIN", "first node"} {
+		if !strings.Contains(text, want) {
+			t.Errorf("the android bundle does not explain itself; missing %q", want)
+		}
+	}
+}