docs: add adb one-liner to read an app's signer SHA by package name

[Xiddoc]

What

Adds a single, copy-pastable adb command to docs/reference/schema.md, right next to the signer_sha256 provenance-field description, that reads an app's signer SHA-256 given only its package name.

PKG=com.example.app; adb pull "$(adb shell pm path "$PKG" | tr -d '\r' | sed -n 's/^package:\(.*base\.apk\)$/\1/p')" /tmp/base.apk && apksigner verify --print-certs /tmp/base.apk | grep -i 'SHA-256'

Why

The docs describe the signer_sha256 field's canonical form but never showed how to obtain the value in one step. The starting snippet (apksigner verify --print-certs /data/local/tmp/base.apk | grep -i 'SHA-256') assumed you already had the base APK on hand. This version resolves the base APK path from the package name (pm path), pulls it, and prints the digest.

Notes

• apksigner already emits the colon-free, lowercase hex form the signer_sha256 field requires — no post-processing needed.
• tr -d '\r' strips the carriage return adb shell appends; the sed extracts just the base.apk entry from pm path output (which lists split APKs too).
• Docs-only change; no schema, map, or CI surface touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QXorW4zR6ABUWH5Ev4pMug

---

Generated by Claude Code