test(adb): restore fixtures and the quoting regression after listing changes

3bdc8730b made the shared shellStub escape backslashes so fixtures carry
exact bytes. The logcat and pm list fixtures still spelled line breaks
as \\n for printf %b, so their output collapsed into one line.

The same commit moved list_adb_directory from `ls <path>` to a remote
`sh -c 'cd "$1" ... find ...' rea-list-directory <path> <script>`. The
quoting regression still faked `ls`, which is never called, so it
observed nothing. Record the arguments the device shell's `sh` receives
instead, and require the caller path to arrive as one intact argument.
The test fails if adb shell operands are left unquoted.

Fixes #2064

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/adb/AdbProvider.test.ts

@@ -495,7 +495,7 @@ it("reads a bounded logcat dump with the caller count and buffer", async () => {
   const { binary } = await writeAdbStub(
     shellStub({
       logcat:
-        "08-10 13:00:00.000 I/Tag( 123): first\\n08-10 13:00:01.000 I/Tag( 123): second\\n",
+        "08-10 13:00:00.000 I/Tag( 123): first\n08-10 13:00:01.000 I/Tag( 123): second\n",
     }),
   );
   const result = await evidenceResult(providerOver(binary), {
@@ -903,7 +903,7 @@ it("resolves packages by case-insensitive substring", async () => {
   const { binary } = await writeAdbStub(
     shellStub({
       "pm:list":
-        "package:/data/app/x/base.apk=com.whatsapp\\npackage:/data/app/y/base.apk=com.whatsapp.w4b\\npackage:/data/app/z/base.apk=com.example\\n",
+        "package:/data/app/x/base.apk=com.whatsapp\npackage:/data/app/y/base.apk=com.whatsapp.w4b\npackage:/data/app/z/base.apk=com.example\n",
     }),
   );
   const result = await evidenceResult(providerOver(binary), {
@@ -1111,10 +1111,11 @@ it("quotes caller text before adb joins the remote shell command", async () => {
   const { binary, root } = await writeAdbStub(
     (root) => `if [ "$1" = "version" ]; then ${VERSION_BLOCK}; exit 0; fi
 shift 3
-# Model adb's remote command joining, then execute the resulting shell string.
+# Model adb's remote command joining, then let the device shell parse the
-printf '#!/bin/sh\nprintf "%%s" "$@" > "${join(root, "observed")}"\n' > "${join(root, "ls")}"
+# joined string. Its \`sh\` records the arguments it receives.
-chmod +x "${join(root, "ls")}"
+printf '#!/bin/sh\nprintf "%%s\\\\000" "$@" > "${join(root, "observed")}"\n' > "${join(root, "sh")}"
-PATH="${root}:$PATH" sh -c "$*"
+chmod +x "${join(root, "sh")}"
+PATH="${root}:$PATH" /bin/sh -c "$*"
 `,
   );
   const value = `/sdcard/a 'quoted'; touch ${join(root, "injected")}`;
@@ -1122,7 +1123,8 @@ PATH="${root}:$PATH" sh -c "$*"
     operation: "list_adb_directory",
     input: { serial: "device", device_path: value },
   });
-  expect(await readFile(join(root, "observed"), "utf8")).toContain(value);
+  const observed = (await readFile(join(root, "observed"), "utf8")).split("\0");
+  expect(observed.slice(2, 4)).toEqual(["rea-list-directory", value]);
   await expect(readFile(join(root, "injected"))).rejects.toThrow();
 });