During a mobile application assessment, a penetration tester discovers that a corporate Android tablet used for kiosk purposes has ADB (Android Debug Bridge) exposed over the network on TCP port 5555 with no authentication. The tester can already reach the device from their laptop on the same segment. Which command allows the tester to install a repackaged, instrumented version of the target APK onto the device to observe runtime behavior and hook API calls?