Harbor 0.2.0-alpha04

This alpha hardens work-profile policy boundaries, app shortcuts, cross-profile navigation, and dependency reproducibility.

Highlights

Keeps APK installation restricted after provisioning until the user explicitly enables it in the work-profile UI.
Warns that Android's generic cross-profile share filters may offer selected files to other work-profile apps.
Pins launcher shortcut mappings to the target app's current signing certificate and invalidates stale identities.
Uses Android's public CrossProfileApps reachability model when opening the work-profile Harbor instance.
Refreshes Kotlin, AndroidX, DataStore, Compose, and coroutines dependency pins with updated lockfiles and verification metadata.
Refreshes README screenshots from a physical Samsung SM-S921B running Android 16/API 36.

No hidden APIs, reflection, arbitrary shell, network access, telemetry, or new heavy dependencies were added.
Existing work-profile file import behavior is unchanged; the storage-quota policy remains outside this alpha's scope.
Monstera-signed APKs are for direct alpha testing and are separate from the future F-Droid signing key.

testDebugUnitTest, lintDebug, assembleRelease, and generateSbom pass.
Manifest permission audit and unsigned APK reproducibility checks pass.
Signed APK installed and launched through ADB on Samsung SM-S921B; package version 6 and APK Signature Scheme v3 verified.