Guardrail: connected tests refuse to run without an emulator ANDROID_SERIAL

Post-incident: an unscoped connectedDebugAndroidTest fanned out to every
adb device including the personal phone, where the debug test APK's
signature mismatch was resolved by UNINSTALLING the release app — wiping
its data. The v1->v2 Room migration was initially blamed but is innocent
(three emulator replays preserved data; dumpsys firstInstallTime ==
lastUpdateTime proved the phone got a fresh install, not an upgrade).
connected* tasks now fail fast unless ANDROID_SERIAL names an emulator.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CLAUDE.md

@@ -90,5 +90,9 @@ All gradlew calls need `JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64` — system
 - Verify alarms: `adb shell dumpsys alarm | grep meddetsamme` — `window=0` means exact
 - The phone (Pixel 7 Pro) has a RELEASE-signed install: `adb install` of debug builds is
   rejected on signature; use release builds for the phone, emulator for debug.
+- **INCIDENT RULE (2026-06-10, data was lost): never run a device-touching command
+  unscoped.** Every `adb` call gets `-s <serial>`; connected tests get
+  `ANDROID_SERIAL=emulator-<n>`. The build fails connected* tasks without an emulator
+  serial — that guard stays. The phone is never a test target.
 
 See @README.md for architecture detail.