Harden #2994 RCS release candidate: consent, signing, and Gaia recovery

[keeltrace]

Scope

This is a release-hardening follow-up stacked directly on the current rcs-bounty-2994 head used by microg#3784. It is not a competing microg#2994 implementation and does not replace or re-claim the underlying bounty solution.

Base verified before submission: 276523b1d3e136b5b6e4ba0cf3f505b6702d60e2 (includes the multipart MT-SMS fix merged in #5).

Hardening changes

• Preserve RCS consent returned in rcs_consent when no matching Gaia consent entry exists, while keeping a matching Gaia consent authoritative when present.
• Add focused JVM regression coverage for Gaia-vs-RCS consent precedence/fallback behavior.
• Stop silently converting Constellation ECDSA signing failures into an empty signature; fail explicitly so callers cannot send malformed client-auth payloads as if signing succeeded.
• Recover Gaia account IDs when GoogleUserId is either missing (null) or empty, rather than only when it is exactly the empty string.
• Enable the focused Asterism unit-test source set and JUnit dependency required for the new regression suite.

Release intent

The goal is to reduce silent failure modes and carrier/account-dependent edge cases in the consolidated microg#2994 release candidate while preserving all existing winner functionality beneath this branch.

Non-claims

• No claim of new end-to-end locked-bootloader hardware validation.
• No claim that this supersedes Implement Constellation and Asterism + DroidGuard fixes for RCS support microg/GmsCore#3784 or its contributors.
• No full-bounty claim; this is a narrow release-hardening contribution.

Verification

The branch is rooted exactly at the current rcs-bounty-2994 head and is 0 commits behind it at submission time. CI should exercise the full project build/lint lanes; the added Asterism tests specifically cover the new consent resolver behavior.

Related: microg#2994, microg#3784.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[keeltrace]

CI note / baseline comparison:

The PR run (34962951821) reached a successful Debug assemble, then failed in the repository-wide lintDebug step; the parallel Release lane was cancelled by the matrix after that failure.

This is the same pre-existing workflow failure shape as the winner/base branch at c23a34c8 (34576553046): Debug assemble succeeds -> repository-wide lintDebug fails -> Release lane is cancelled. In other words, this PR did not introduce the red full-repo lint gate; the stacked base was already red on that gate.

Independent Keeltrace proof for the underlying RCS hardening line is green (34537649271): focused RCS JUnit, changed-module Constellation lintDebug, and independent assembleRelease all passed. The present stacked PR is also 0 commits behind the current rcs-bounty-2994 head and preserves the newer multipart MT-SMS fix unchanged.

I am therefore treating the full-repo lint result as an inherited base-branch blocker, not papering it over in this narrow release-hardening PR.