v1.3.0

What's new

• Provenance sidecars: each downloaded APK now gets a <file>.meta.json (package, version, source, download URL, streamed sha256) for downstream extraction pipelines.
• sha256 computed during streaming — no extra read cost even on 1GB+ .xapk files; existing files are rehashed on rerun.

🤖 Generated with Claude Code