v0.2.3 - finish PermissionDiff UI to make build green

- Add PermissionDiffBlock composable in AppCard.kt; the call site existed but the function definition was missing, breaking release builds.
- Cover the new CardStatus.PermissionReview branch in CatalogSearch.searchBoost (was a non-exhaustive when).

Release v0.2.0 — Hardening pass

Closes the Android 14/15/16 platform-compliance gap and completes the install-flow
primitives that v0.1.0 stubbed. Roadmap items 1, 2, 3, 4, 7, 8, 11, 12, 13, 16, 17,
19, 22, 24 (14 of 24 v0.2 Now items). The rest carry forward into v0.2.1+.

Install mechanics + signature pinning correctness:
- setRequestUpdateOwnership(true) on first install (API 34+) + ENFORCE_UPDATE_OWNERSHIP
  permission. Closes the silent-publisher-swap gap left by v0.1's signature pin.
- setPackageSource(PACKAGE_SOURCE_STORE) on every session — exempts downstream apps
  from Restricted Settings on Android 13+.
- Explicit installer attribution: setInstallerPackageName, setOriginatingUid,
  setReferrerUri populated from the GitHub release URL.
- Lineage-aware signature verification via apksig:8.7.3. APK Signature Scheme v3 / v3.1
  publisher key rotations are accepted automatically (pinned cert in the new APK's
  signing-cert lineage; the new cert is signed by an earlier lineage entry); pin rolls
  forward on success. Forged APKs without a valid lineage chain still hard-reject.
- Decoded STATUS_FAILURE_* messages — replaces "App not installed" with concrete causes
  (signature conflict, ABI/SDK incompatibility, storage shortage, restricted-state).

Platform compliance:
- POST_NOTIFICATIONS runtime permission flow + manifest entry.
- FOREGROUND_SERVICE_DATA_SYNC permission declared (preempts v0.4 WorkManager).
- Network Security Config: api.github.com, objects.githubusercontent.com,
  codeload.github.com, raw.githubusercontent.com pinned at root CA SPKI (DigiCert
  Global Root G2 + ISRG Root X1 backup, 6-month expiration). Cleartext disabled.
- Adaptive icon <monochrome> layer — clean single-color glyph for Themed Icons.
- enableOnBackInvokedCallback="true" already on application; predictive-back ready.

Observability:
- Install audit log on disk: <files>/logs/install.log JSONL, rotates at 256 KB,
  records install_ok / install_blocked / install_failed / uninstall_initiated events.

Docs:
- README threat model section: explicit trust boundary, what we trust / don't trust /
  don't do, plus user-facing verify-the-release recipe.
- CHANGELOG entry with cert SHA-256 transparency line.
- ROADMAP.md document version 2.1 with v0.2.0 partial-ship status header.

Build:
- versionCode 2, versionName 0.2.0
- apksig:8.7.3 added
- Release APK: 2.31 MB signed
- Cert SHA-256: 9c6a927620d5a3ee033e4d2bd1007928d513484e1a9edbf3423b816e6ebd3a0d
  (unchanged from v0.1.0)
- APK SHA-256: 41b950808635f592491608ddaec7e63ca904cdec6e3c937b04b999e163e3921f

Initial commit — LocalAndroidStore v0.1.0

Personal Android-app catalog sourced from GitHub Releases. Android sibling
of LocalChromeStore: card grid, install / uninstall / update / open buttons,
PackageInstaller-Session install path, signature pinning per applicationId,
EncryptedSharedPreferences for the GitHub PAT, AMOLED + Catppuccin theme.

Kotlin 2.1, AGP 8.7.3, Compose BOM 2024.12.01, Material 3, minSdk 26,
targetSdk 35, R8 + resource-shrink in release.