[RELEASE-005] Securely update direct Android APK installs

[veryCrunchy]

Goal

Let Android installations obtained directly as APKs discover and install trusted project updates without interfering with Play Store, F-Droid, or other package-manager-owned installs.

Requirements

• Detect the installation source and enable the direct-update channel only for direct APK installs or an explicitly compatible project channel.
• Fetch versioned release metadata from one canonical HTTPS endpoint with strict size, timeout, redirect, and schema limits.
• Compare Android version codes and supported SDK requirements before offering an update.
• Download into app-controlled temporary storage with resumable progress and clear cancel/retry states.
• Verify the published SHA-256 digest and the APK signing certificate identity before offering installation.
• Reject downgrades, package-name mismatches, incompatible SDK levels, signature changes, malformed metadata, and unverified downloads.
• Use Android's user-confirmed package installer flow and unknown-app-source settings where required. Never silently install or bypass platform consent.
• Clean up stale or rejected downloads and avoid exposing APK files through broad storage permissions.
• Present release notes in plain language with optional technical details.

Acceptance criteria

• Direct APK installs can check, download, verify, and hand off a valid update to Android for confirmation.
• Store-owned installs are directed to their owning store and never use the direct updater.
• Tampered metadata, APK bytes, wrong package names, wrong signing identities, and downgrade attempts are rejected before installer launch.
• Interrupted downloads can recover without duplicating unbounded files.
• Automated tests cover source-channel routing, version comparison, metadata bounds, checksum/signature verification, cleanup, and failure states.