Reproducible updaters for bundled lists + Disconnect category-drift flag

[kasnder]

What & why

Several remote datasets are bundled in app/src/main/assets/ and read straight from the read-only APK, so they can only be refreshed by shipping a new build. Only the on-device hosts blocklist had an update path; the identification lists (Disconnect/shavar, DuckDuckGo TDS, GeoLite2) were refreshed by hand — easy to forget, and their provenance was undocumented.

Rather than add on-device fetches (a privacy cost for data that changes slowly, and GeoLite2 is license-gated anyway), this refreshes them at build time and captures the source + transform for each.

Updaters (stdlib-only, --check/--input, validate-before-write, write-only-on-change)

Script	Source	Transform
scripts/update_disconnect_list.py	Disconnect services.json (the list Mozilla repackages as Firefox "shavar")	byte-reverse (AV workaround, #30)
scripts/update_ddg_tds.py	DuckDuckGo Android TDS	field-strip to {owner:{name,displayName}, default} — the only fields the loader reads (~1.6 MB → ~100 KB)
scripts/update_geolite2.py	MaxMind GeoLite2 (needs MAXMIND_LICENSE_KEY)	download tar.gz → extract .mmdb

These follow the same convention as scripts/update_exodus_trackers.py from #622, which stays the single Exodus updater — the workflow calls it if present and no-ops otherwise, so there's no duplication.

.github/workflows/update-lists.yml runs the set monthly (and on demand) and opens a PR. The PR's existing Test CI is the gate that vets a bad upstream.

Disconnect category-drift flag

Disconnect occasionally renames/adds categories. The app already handles unknown categories safely — they fold to Uncategorised via canonicalise (#571) — but silently, so a rename would quietly drop trackers out of their bucket unnoticed.

• The Disconnect→bucket mapping is refactored out of the inline switch in loadDisconnectTrackers into TrackerCategory (DISCONNECT_ALIASES + mapDisconnectCategory / isRecognisedDisconnectCategory) — one testable source of truth. Behavior-preserving.
• DisconnectCategoryCoverageTest reads the bundled list and fails the build if any category can no longer be mapped to a UI bucket — turning silent drift into a loud CI failure, regardless of how the asset was updated.

Notes

• No asset data changes here. The updaters were run and reverted; this PR ships mechanism only (data refreshes belong in their own test-gated PRs, as in Add reproducible Exodus tracker-signature updater script (#318) #622).
• Depends on Add reproducible Exodus tracker-signature updater script (#318) #622 for Exodus (skipped gracefully until it lands).
• GeoLite2 needs a MAXMIND_LICENSE_KEY repo secret to be included; otherwise it's skipped.

Verification

• All three scripts: live --check, real write + idempotency, clean revert; GeoLite2 no-key path errors cleanly.
• testFdroidDebugUnitTest green: DisconnectCategoryCoverageTest + TrackerListModeTest + BlockingBaselineSubsetTest pass; the refactor is behavior-preserving.

Related: #622

🤖 Generated with Claude Code