ADFA-4898 (follow-up): in-flight controls for a running proot module install — confirmed cancel + stall hint

[luisguzman-adfa]

The remaining in-flight controls of ADFA-4898 (which shipped failure surfacing + retry): cancel
a running module install, and a movement-based stall hint. Plus localization of the new strings.

P5 — confirmed cancel + immediate retry

Cancel a running module from its live card: a strong confirmation, then a clean kill of the
runrole (proot --kill-on-exit takes its container children), local_vars rolled back to
install/enabled: False so a half-installed module is never offered as installed, and the module
marked failed so the existing per-module Retry appears at once. Ordering mirrors
finishModuleQueue (InstallGuard cleared before postDone) so the pdsm-stopped server restarts; the
base system is untouched. Cancel reuses the host detail bar's secondary slot (Back stays primary).
revertModuleInLocalVars now writes explicit False (was delete-only), covering the graceful-failure
path too.

P4 — movement-based stall hint (surface only)

A running module with no runrole output and no write-directory growth for a generous window
(120s) surfaces a "seems stalled" hint on the live card, next to the Cancel/Retry escape. It
never auto-kills: the foreground service keeps running and the hint clears when movement resumes.
Heartbeat on each log line + a bounded, file-capped write-dir growth backstop for quiet network
phases (e.g. calibre-web's git clone). Published via a separate stalled LiveData kept out of the
immutable ModuleQueueState. The per-module write-dir map is best-effort and logs if a module is
unmapped, so the fallback is visible, not silent.

Strings / localization

The 5 new strings (P4 hint + P5 cancel-confirm dialog) live in strings.xml and are translated
across all 33 locales. The non-English translations are best-effort and should get a
native-speaker / translation-service review before release.

Not in scope

No pause/resume, no auto-kill-on-stall (the foreground service is the keep-alive guardian), no
byte-level resume inside the runrole (role-side).

Verification (device — OnePlus 7T, Android 15)

• P5 — PASS (all): cancel stops the runrole, rolls local_vars to install/enabled: False, surfaces
  "Couldn't install" + Retry at once, base system intact (server restarts, marker cleared, no
  Recover), and Retry reinstalls cleanly to Installed.
• P4 — PASS: never appears during a healthy install; appears after ~120s of no output and no
  write-dir growth (forced by freezing the runrole with SIGSTOP), never kills the install, and
  clears the moment movement resumes.

Known follow-up (separate, not this PR)

A pre-existing reliability issue in the post-install server restart / auto-hand-off to Library
(the index can hang on "sending you to your library" until a relaunch). Not caused by this change;
to be filed as its own bug (ADFA-4919 area, not ADFA-5330).