v0.10.3 — Fix: selftest crashes in installed checkouts

Android Agent Harness v0.10.3

Bug-fix release: the self-test suite no longer crashes when run from an installed app checkout. Reported by a user performing a fresh install of v0.10.2 following docs/install-prompt.md exactly.

The bug

python .agents/scripts/_hook_selftest.py crashed in any installed checkout (only agents/ is copied per the documented install flow) because three probe groups assumed the kit-root layout:

1. Grants-example probe (_hook_selftest.py:528) resolved templates/gemini-runtime/config.grants.example.json from the app repo root -> FileNotFoundError.
2. harness_cli.py probes (lines 593/604): an explain subprocess plus import harness_cli -> ModuleNotFoundError, since the CLI ships at kit root and is never copied.
3. Fixture builder import: from make_android_fixture import ... resolved scripts_dev/, also kit-only.

Ironically, the same file already contained a graceful skip for one CLI test ("OK (skipped - installed checkout)"); the newer v0.9.x/v0.10.x groups did not follow that pattern.

Fixes

• New KIT_LAYOUT detection; all kit-only probes now degrade to explicit OK (skipped - installed checkout) lines instead of crashing.
• When scripts_dev/ is absent, minimal equivalent fixture builders are defined inline, so the flavor-discovery, multi-module, wizard pre-fill, and doctor-remediation engine tests keep running everywhere rather than being skipped.
• review_package.py: GIT_SHA and ledger git_sha now accept only a valid 40-hex commit hash (empty outside a git repository), keeping package headers and ledger comparisons sane in non-git contexts.
• Changelog consolidation (folded patch 0.5.4) to hold the milestone cap.

Verification

• Kit checkout: _hook_selftest.py Total test failures: 0; security suite 0; preflight PASSED; doctor failures: 0.
• Installed-checkout simulation (copying only agents/ into a clean directory): exit code 0, zero tracebacks, ten explicit skip lines, Total test failures: 0.