A remote caller's adb reverse and forward reach its own machine, not the worker #1100

The problem

We run agents on three machines. Only one of them, the worker Mac, has the devices and the simlock CLI; the other two call the gateway's HTTP API by hand (lease-requests, exec, DELETE). #945 covers the missing CLI transport. This is the part it doesn't cover.

exec runs its command on the worker. So adb reverse tcp:5173 tcp:5173 or adb forward from a remote agent connects the device to port 5173 on the worker, not on the agent's machine. The device can't reach a dev server or a candidate build served on the caller's machine. Every device test of a local build has to move to the worker, which also competes with the timing measurements we run there.

Who runs into this

A coding agent or CI job on a machine other than the worker that serves its app under test locally (a Vite dev server, a mock API, a local web build) and wants a leased device to load it.

What you would like to happen

A remote caller can expose a port on its own machine to its leased device, and reach a port on the device from its own machine, through the gateway and the worker:

• device → caller: the device's localhost:<port> reaches the caller's localhost:<port>, as adb reverse does today for a caller on the worker;
• caller → device: the other direction, as adb forward does.

The tunnel lives as long as the lease, and only the lease holder can open one. It works for Android emulators, enrolled Android phones and iOS simulators. For a simulator, which shares the worker's network, that means a port on the worker that tunnels to the caller.

Anything else

• The fleet serves only agent-device users: CLI agents, CI runners and operators each hit a gap #945: the CLI has no remote mode. It names the build-upload gap but not this one.
• Host ports leased with the device #162 / Lease host ports together with the device #155: host ports leased with the device. That covers ports on the worker, not a tunnel back to the caller.
• The gateway already holds two-way byte channels to workers (feat(gateway): a gateway module can hold a two-way byte channel to a worker module #1026), which may be the transport.

Written by an agent.