fix: pre-v0.1 review feedback (#14)

* fix(sdk-android): add @JvmOverloads to Uatu.start

Java callers can now invoke start(application) without supplying a
Configuration, matching the Kotlin default-arg ergonomics.

* feat(agent): add protocol_version to HELLO handshake

ProtocolVersion=1 lives on Message and is set by Hello(). Server.Accept
rejects mismatches with a clear error. SDK upgrades that don't change
the wire format keep the same protocol_version; bump on breaking changes.

* test(agent): assert protocol_version in Hello round-trip

* feat(sdk-android): send protocol_version=1 in HELLO

Mirrors agent.ProtocolVersion on the Go side. Bump in lockstep with
the Go constant when the wire format breaks.

* chore(sample-app): pull @uatu/spec from npm next tag

Replaces the file: dep. Copy-paste users can now npm install against
the registry. The release workflow publishes pre-release tags to
npm dist-tag 'next', so the sample tracks the latest rc without
manual version bumps. Lockfile currently resolves to 0.0.1-rc3.

examples/sample-app/package-lock.json

@@ -6,23 +6,15 @@
     "": {
       "name": "uatu-sample",
       "devDependencies": {
-        "@uatu/spec": "file:../../pkg/spec-api"
-      }
-    },
-    "../../pkg/spec-api": {
-      "name": "@uatu/spec",
-      "version": "0.0.0-dev",
-      "dev": true,
-      "license": "Apache-2.0",
-      "devDependencies": {
-        "@types/node": "^22.7.5",
-        "tsx": "^4.21.0",
-        "typescript": "^5.9.3"
+        "@uatu/spec": "next"
       }
     },
     "node_modules/@uatu/spec": {
-      "resolved": "../../pkg/spec-api",
-      "link": true
+      "version": "0.0.1-rc3",
+      "resolved": "https://registry.npmjs.org/@uatu/spec/-/spec-0.0.1-rc3.tgz",
+      "integrity": "sha512-mCayssOqM2wfzrQDnFGE8FAlUlDzBl1fx2L/MLDIuPrQHBMlUC350xBB8Z7I/DYI98eCWJMqjtw3iU6yVWKtIQ==",
+      "dev": true,
+      "license": "Apache-2.0"
     }
   }
 }