doc: correct drift and move the build notes to the root

The Rsync comment about draining a hostile remote's pipe sat on the
Tally type, where it means nothing; it describes boundedLines. Scheduler
explained itself with what happened during development instead of the
constraint that WorkManager persists unique names across upgrades, and
MainActivity and SyncLog did the same. Keys pointed at a pin() that does
not exist. The App header restated the class name and omitted half of
what onCreate does. OUT_FORMAT had no caller outside its file.

The README layout list omitted fastlane. The e2e test hardcodes a copy
of the app's rsync vector with nothing saying so. useradd already writes
a locked password field, so "skip passwd -l" does not leave a non-locked
one and key auth is still refused; verified against sshd with UsePAM no.
The CI file also runs verify-repro on a tag, and the NDK and build-tools
are pinned by revision and verified against Google's manifest rather
than a checksum this repository owns, which the reproducibility notes
claimed for every input.

metadata/ held one document and nothing else, and reads as a store
metadata directory beside fastlane/metadata. Root, extensionless,
beside THIRD_PARTY.

2 files changed, 5 insertions, 2 deletions

diff --git a/rsh/e2e_test.go b/rsh/e2e_test.go
index e6f82b9..f4b44b4 100644
--- a/rsh/e2e_test.go
+++ b/rsh/e2e_test.go
@@ -46,6 +46,9 @@ func TestEndToEndRealRsync(t *testing.T) {
 	mustWrite(t, filepath.Join(src, "sub", "b.bin"), "\x00\x01\x02\x03beta")
 	mustWrite(t, filepath.Join(src, "sub", "c.txt"), "gamma gamma gamma")
 
+	// These flags are a copy of the vector Rsync.args builds in the app. Nothing
+	// links the two, so changing one without the other leaves this test proving
+	// an argument vector the app no longer runs.
 	runRsync := func(mirror bool) {
 		t.Helper()
 		args := []string{
diff --git a/rsh/transport_test.go b/rsh/transport_test.go
index d06f086..1afa1cf 100644
--- a/rsh/transport_test.go
+++ b/rsh/transport_test.go
@@ -148,8 +148,8 @@ func TestDialTimeoutFromEnv(t *testing.T) {
 	}
 }
 
-// A host we cannot reach must be reported with the marker the app greps for,
-// so it can skip the rest of the folders bound to that remote.
+// An unreachable host must be reported with the marker the app greps for, so it
+// can skip the rest of the folders bound to that remote.
 func TestUnreachableHostIsMarked(t *testing.T) {
 	keyPath, pub := genClientKey(t)
 	srv := newTestServer(t, pub, func(_ string, _ io.Reader, _, _ io.Writer) int { return 0 })