Add controller input and a laser-pointer-driven menu quad

- xr_input.c/h: an OpenXR action set (aim pose, trigger/select click, a
  menu-toggle button) plus ray/quad hit-testing, and a visible
  laser-pointer line drawn from the controller toward the hit point.
- xr_menu.c/h + MenuOverlay.java: a second composition-layer quad,
  toggled by a controller button, showing an off-screen, never-attached
  Android View tree (one "Keyboard" button so far) driven by synthetic
  touch events computed from the laser ray's hit UV.
- Migrate gl4es from a prebuilt binary baked into the Docker build-image
  to a vendored source snapshot (android/gl4es-src/) compiled from
  source at APK build time via CMake add_subdirectory(), patched through
  a new android/gl4es-patches/ (mirrors the existing engine-patches/
  pattern). This was needed to track down and fix a bug hit while
  building the menu: gl4es's fixed-pipeline emulation (fpe.c) was
  unconditionally substituting its own shader onto the menu's draw call
  (fpe_ReleventState() always sets alphafunc to a nonzero sentinel, so
  its fpe_IsEmpty() check could never see the state as empty), making
  the menu quad show the game's own rendering instead of its own
  content. Fixed by routing the menu's blit through a real
  glBlitFramebuffer() call instead of a shader-based draw, which gl4es's
  fpe.c has nothing to intercept - documented in README.md's new
  "Debugging notes" section.
- Renumber android/engine-patches/ to close the gap left by removing an
  unrelated diagnostic-only patch, and strip investigation-journal
  comments and dead diagnostic code (temporary tracing, env-var probes)
  left over from finding the bug above.
- Restructure README.md into numbered sections, document every
  engine/gl4es patch, add Android Studio dev/testing-cycle instructions,
  and generalize Quest-specific wording to any OpenXR headset. Update
  NOTICE.txt to match (gl4es is now vendored/patched source, not a
  prebuilt binary; add the OpenXR-SDK loader).

android/gl4es-src/spec/template/client.c.j2

@@ -0,0 +1,52 @@
+{% extends "base/wrap.c.j2" %}
+{% block headers %}
+#include <sys/syscall.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdio.h>
+{{ super() }}
+
+{% endblock %}
+
+{% block main %}
+{{ super() }}
+
+snd_config_t *snd_config = NULL;
+
+__GLXextFuncPtr glXGetProcAddressARB(const GLubyte *name) {
+    {% for func in functions %}
+    {% if not func.name.startswith('snd_') %}
+    if (strcmp(name, "{{ func.name }}") == 0) {
+        return (void *){{ func.name }};
+    }
+    {% endif %}
+    {% endfor %}
+    printf("glXGetProcAddress(%s) not found\n", name);
+    return NULL;
+}
+
+__GLXextFuncPtr glXGetProcAddress(const GLubyte *name) {
+    return glXGetProcAddressARB(name);
+}
+{% endblock %}
+
+{% block definition %}
+#if !defined(skip_client_{{ func.name }}) && !defined(skip_index_{{ func.name }})
+{{ super() -}}
+#endif
+{% endblock %}
+
+{% block call %}
+    {{ func.name }}_INDEXED packed_data;
+    packed_data.func = {{ func.name }}_INDEX;
+    {% for arg in func.args %}
+    packed_data.args.a{{ loop.index }} = ({{ arg.type|unconst }}){{ arg.name }};
+    {% endfor %}
+    {% if not func.void %}
+    {{ func.return }} ret;
+    syscall(SYS_proxy, (void *)&packed_data, &ret);
+    return ret;
+    {% else %}
+    syscall(SYS_proxy, (void *)&packed_data, NULL);
+    {% endif %}
+{% endblock %}