fix: verify Android installation identity on both API images

[deku2026]

Fix the public upgrade verifier on API 36, whose real package dump uses appId instead of the older userId label. Parse either observed label only for emulator user 0, reject missing/ambiguous identity fields, retain raw before/after dumps, and exercise the same reader on both PR emulator images before publication.

The defect was observed after PR #4 merged: release 0.1.0-ci.12.1, its anonymous downloads, persistent signatures, all candidate payloads and the API 26 upgrade passed; the API 36 verifier failed before upgrading. That release/evidence is retained. This correction remains within WP00.03.

Validation: 49 Python tests, both retained real API 26/36 before/after package dumps, source provenance, naming, repository checks, actionlint and full diff review passed. All applicable PR CI must pass before merge; the new main release still requires both actual public persistent-signature upgrades and independent public-byte verification afterward.

[deku2026]

Complete review of the four-file diff at 856d93b: no outstanding findings. The two accepted identity labels are demonstrated by retained actual API 26/36 package dumps; user 0 is required before treating the application ID as UID. Missing/ambiguous fields fail, exact package/version binding is retained, and both public-upgrade continuity assertions remain mandatory. Raw before/after dumps are retained for diagnosis. The same reader now executes on both PR image jobs, so this observed post-publication defect is covered before another merge.

Local evidence passed: 49 Python cases, real retained before/after dumps on both APIs, source provenance (110 files / 18 immutable records), naming, repository/whitespace checks, actionlint, and full-history gitleaks. There are no application payload, dependency, admission, signing, package identity or scope changes. CI and final public upgrades are still pending and are not claimed by this review.

[deku2026]

Final merge review: all applicable checks on 856d93b are green, including both OS builds, all security checks, API 26/36 real UI/Cloud calls and the new actual installed-identity gate. The final remote patch matches the reviewed local change. No outstanding findings. Main-only protected publication and both public upgrades remain required after merge.

CI: https://github.com/ArcForges/Mobile/actions/runs/35443710177

[deku2026]

Post-merge verification completed for 5031d83 and public android-0.1.0-ci.14.1.

• All main CI gates passed: https://github.com/ArcForges/Mobile/actions/runs/35444269638
• Independently downloaded all eleven public assets anonymously; GitHub asset digests, release/SHA256SUMS, source/notice/resource companions and every original candidate payload match. All 454 members of the four Android archives remain source/profile-bound.
• Actual APK and AAB certificates both match the retained persistent SHA256 7a8b3b1402e77c3ec78e7a0b9f99d5358adc321d0e8d2a319c838d1cda181e9c. Public APK SHA256 is 418c406dd4b1cd12b5cd9b489a863340e3c6ccb172d8aa8809ad0c14de4d4de9.
• API 26 and 36 each passed five instrumentation tests, eight actual SDK calls with expected success/error/deadline results, native UI recreation and the minified-release Cloud button call. The observed Native AOT Cloud source is 3165c97cccd3ea1e0b230d66e22ab9c775ca19d8.
• Both independent public upgrade jobs installed ci.9.1 and upgraded version code 901 to 1401, preserving UID and first-install time. The actual public APK completed one real Cloud button call on each API. Raw package dumps, upgrade receipts and both screenshots were independently reviewed.
• The exact merged source passes provenance (110 inventoried files, 19 reused, 18 retained records); primary main was pulled and is clean. Branches, both correction worktrees and all earlier evidence/releases remain retained.

Release: https://github.com/ArcForges/Mobile/releases/tag/android-0.1.0-ci.14.1
The ci.12.1 API 36 verification failure remains recorded; this reviewed correction and final passing release supersede its incomplete upgrade proof. WP00.03 has no unavailable external prerequisite. Local emulator startup was rejected by automatic approval review with blocked by policy; required emulator evidence was obtained in CI. No physical-device, store or full companion-product readiness is claimed.