fix(contracts): share ADB limits and preserve Rosetta register facts

Use the domain-owned activity extra count in CLI parsing and advertisement. Preserve nested Rosetta registers at the selecting parser and qualified register projection, sharing the existing aggregate budget.

Port the Rosetta work from Adolanium commits 1889ac153 and c9e93bd88 in #6976, including morluto follow-up 07fa932ee. Add malformed-container and mixed-thread budget controls. CLI/MCP coverage uses a recorded ReportCrash excerpt in an authored report, without generating a native crash or contacting an Android device.

Refs: #6291, #6976, #6977

Co-authored-by: Adolanium <94890352+Adolanium@users.noreply.github.com>

docs/apple-ips.md

@@ -38,6 +38,12 @@ address uses that row's own image base and offset. The recorded `inline` flag
 does not supply a missing offset or authorize borrowing another row's address.
 When `faultingThread` is missing or does not resolve to a recorded thread
 object, row-zero roles are `unknown`; the recorded lookup remains available.
+A translated process records Rosetta's registers in a nested
+`threadState.rosetta` object; each one is reported as `rosetta.<name>` and
+counts toward the register budget. A [public ReportCrash `.ips` log](https://github.com/Mortennn/Dozer/issues/189)
+shows `rosetta.tmp2`, `tmp1`, and `tmp0` beside ordinary x86 registers. The
+test fixture quotes that register excerpt inside an authored report body; it
+does not generate a new Rosetta crash during the test.
 Observed JSON strings retain `""`; `null` means the field was missing or JSON
 `null`. This includes image paths, frame symbols, process text, and the older
 string `osVersion` form. Unlisted JSON keys and generic register names also