fix(direct-proof): advance GX6 GATT markers

[trancee]

Summary

• Added passive GATT discovery and completion markers in the proof app server path.
• Added sender-side GATT bridge route markers and a bounded service-discovery retry on the sender client.
• Added a regression test for the passive marker strings.

Verification

./gradlew :meshlink-proof:android:compileDebugKotlin
./gradlew :meshlink-proof:android:compileDebugAndroidTestKotlin

Notes

• The GX6 investigation still shows the GATT transport does not reach retained completion yet.
• This PR captures the smallest runtime marker and retry improvements that moved the failure farther into the GATT handshake.