Widgets: close the rest of the rollover gaps (#228)

Review follow-up on the midnight alarm.

The month widget could still show the wrong month after the rollover, and by way
of the exact workaround #228's reporter described. ShiftMonthAction stored an
absolute index on every tap, so paging forward and back — which looks like a
no-op and was how people forced a redraw — silently pinned the widget to the
month that was current at the time. It kept redrawing correctly and kept drawing
August into September, today's circle nowhere on the grid. Landing back on the
current month now clears the key instead of writing it, so the widget goes back
to following the date. Paging somewhere else and staying there is left alone;
that one is a choice, and the today button undoes it.

The alarm also had no way back once something dropped it without telling us — a
force-stop, a battery-restricted transition, an OEM freeze — short of the user
opening the app. onUpdate is the one wake-up the system still owns through
updatePeriodMillis, so both receivers re-arm from it. That doubles as a window
narrower: setAndAllowWhileIdle's delivery slack scales with how far out the alarm
was set, so re-arming every half hour keeps midnight's window at minutes rather
than hours.

Boot and package-replace now re-arm and stop there. The host sends
APPWIDGET_UPDATE after both, so the redraw was a second pair of wide provider
reads and RemoteViews serialisations in a cold process, exactly when the device
is busiest.

Smaller things: the unreachable lookahead fallback armed 5 seconds out, which
would have been a wake-loop rather than the late redraw the comment claimed —
an hour now. The action guard's comment was copied from ReminderScheduleReceiver
along with its claim that the broadcasts are protected; PROVIDER_CHANGED is not,
and the real reason the guard is worth having is that the receiver must stay
exported. Application start does its sync off the main thread now.

Tests moved onto frozen historical transitions — Berlin 2024 both ways, Havana
2018 — since the 2026 dates they used depend on DST rules that can still change
under a tzdata bump. The Berlin "fall back" case never repeated midnight, so it
now says what it actually checks (a 25-hour day must not overshoot) and a real
repeated-midnight zone, pre-2019 Sao Paulo, pins the known limitation instead of
implying it is handled. Dropped the two assertions that restated the code, and
added the one that was missing: that the receiver's action guard admits the
action the alarm is sent with, which is the single point where the whole thing
would fail silently.

app/proguard-rules.pro

@@ -51,9 +51,11 @@
 # obfuscated name and orphan the stored mapping.
 -keep class * extends androidx.glance.appwidget.GlanceAppWidget
 
-# Same hazard one level up: MonthWidgetReceiver and AgendaWidgetReceiver are
-# also structurally identical (same supertype, same overrides, only a differing
-# property initializer), and Glance's provider map is keyed off the receiver
-# component too. Manifest-declared components are normally kept anyway, but this
-# is cheap and makes the invariant explicit rather than incidental.
+# Belt and braces one level up: MonthWidgetReceiver and AgendaWidgetReceiver are
+# nearly as alike (same supertype, same overrides, only a differing property
+# initializer), and Glance's provider map is keyed off the receiver component
+# too. AGP's manifest-derived keep rules already cover them, and the rule above
+# keeps the two widgets distinct enough that the receivers' constructors differ —
+# so this is redundant today. It is here because #89 cost a release to diagnose
+# and the guarantee should not rest on a component staying in the manifest.
 -keep class * extends androidx.glance.appwidget.GlanceAppWidgetReceiver