fix(campaign): refuse to start on a device that is not there

A sweep launched at six serials, three of which had been deleted from the
host. 19 of 20 runs were lost, and not because half the devices were wrong:
a worker on a dead serial fails in about 31 seconds and immediately pulls
another seed, so three bad workers drained sixteen seeds while the three good
workers were still inside their first run.

Fast failure is more dangerous than slow failure, because the fast failure
consumes the resource the slow one would have left alone.

Preflight names every missing serial before the first seed is dispatched.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

internal/android/android.go

@@ -23,7 +23,7 @@ import (
 //   - else if exactly one AVD exists locally, boot it;
 //   - else fail with a helpful message listing the available AVDs.
 func EnsureDevice(ctx context.Context, serial, avdName string, stdout io.Writer) error {
-	devices, err := listAdbDevices(ctx)
+	devices, err := ConnectedDevices(ctx)
 	if err != nil {
 		return fmt.Errorf("list adb devices: %w", err)
 	}
@@ -358,7 +358,11 @@ var standardSDKRoots = []string{
 	"/usr/local/share/android-commandlinetools",
 }
 
-func listAdbDevices(ctx context.Context) ([]string, error) {
+// ConnectedDevices lists the serials adb reports as online. It goes through
+// the adb CLI so the ADB_SERVER_SOCKET / ANDROID_ADB_SERVER_ADDRESS pair the
+// process was started with selects the same server every other adb call in the
+// run talks to, rather than assuming a server on this machine.
+func ConnectedDevices(ctx context.Context) ([]string, error) {
 	adb, err := AdbBinary()
 	if err != nil {
 		return nil, err