Tell lint that targetSdk 28 is the point

A release build fails on ExpiredTargetSdkVersion, which exists because Play
will not take an sdk that old. It is right about the rule and wrong about this
app: 29+ forbids executing a file from the app's own data directory, which is
the one thing this app exists to do.

app/build.gradle

@@ -65,6 +65,14 @@ android {
         }
     }
 
+    lint {
+        // targetSdk 28 is deliberate and structural: an app on 29+ may not execute a file out of
+        // its own data directory, and executing a rootfs is the whole of what this app does. Lint
+        // fails a release build over it because Google Play will not accept an sdk that old —
+        // true, and not something this app can trade away. Every other check stays on.
+        disable 'ExpiredTargetSdkVersion'
+    }
+
     packagingOptions {
         jniLibs {
             // The PulseAudio daemon is executed from the native library directory and its