PR4B: add upstream differential and security-research lab

[Jordan231111]

Outcome

Implements roadmap PR4B on the frozen f943ecdd baseline as a reproducible upstream-differential and security-research lab.

• Adds a fail-closed official ledger for v30.6 → v30.7, common-ancestor → stable, stable → observed master, and all 178 fork-only commits, with path ownership, toolchain/API/ABI snapshots, range-diff evidence, submodule pins, and targeted gates.
• Audits 373 historical gitlinks. Exactly six unreachable legacy pins are reviewed in policy; any new loss or stale exception fails CI.
• Adds a 251-package dependency/toolchain inventory and SPDX 2.3 SBOM with zero unresolved licenses, reviewed RustSec dispositions without audit ignores, and explicit manager-signature/trust-boundary evidence.
• Adds opt-in four-ABI minimal UBSan builds plus deterministic boot/policy device corpora, SQLite fault injection, module metadata and doctor properties, and update URL/redirect properties.
• Fixes strict pre-mutation module-ID validation, HTTPS downgrade redirect handling, and mapped-length boot-image parsing (truncated headers, aligned blocks, MTK/zImage/DTB/AVB follow-ons, bounded fixed-width names).
• Adds path-scoped PR CI plus weekly/manual upstream, dependency, historical-submodule, RustSec, host-property, all-ABI UBSan, and disposable x86_64 AVD gates.

Finding dispositions

• KITSUNE-2026-001: fixed — malformed module IDs reached destructive paths before validation.
• KITSUNE-2026-002: fixed — truncated boot headers reached unchecked alignment and adjacent parser bounds.
• KITSUNE-2026-003: reviewed hold — inherited libsepol signed 1 << 31; only UBSan shift-base is suppressed pending the PR6 pin, while every other UBSan class remains fatal.

Verification

• 53 host contract/property/fault tests pass.
• Clean release, debug, and UBSan native builds pass for armeabi-v7a, arm64-v8a, x86, and x86_64.
• Gradle app/shared/native/stub debug unit tasks and :app:lintDebug pass.
• Actionlint 1.7.12 and ShellCheck 0.11.0 pass for the new/changed AVD runners; downloaded binaries were SHA-256 verified.
• Upstream ledger/latest-release, license inventory, dependency/SPDX, RustSec, and signature-contract checks reproduce exactly.
• Debug and release APK signatures verify with the same expected TestKey certificate.
• MuMuPlayer 127.0.0.1:16384, ARM64, 4 KiB pages: 977 UBSan parser cases, zero crashes, boot sign/verify passed, policy save/reload passed. Parser sandbox only; /system, partitions, and the instance were not modified.
• Disposable API 35 ARM64 sanitizer AVD: 977 cases, zero crashes, sign/verify and policy round-trip passed; AVD deleted.
• Separate disposable API 35 ARM64 normal-install AVD: debug and release each passed patched-ramdisk boot, manager install/setup, reboot, provider tests, root-context check, and 137 parser cases. Stock ramdisk SHA-256 restored to 46ff502d0e0a1d8f844d29c084a8b797107513d26199825f0d827836a87e84d7; AVD deleted.
• Historical remote probe: 373 gitlinks, exactly six policy-expected unavailable objects, no unknown loss.

Scope boundaries

This does not claim persistent System Mode installation or physical-device recovery. MuMu remained read-only because there is not yet a verified snapshot/restore tuple. PR5 remains conditional on actually shipping the frozen current core; otherwise the roadmap proceeds to the pristine v30.7 PR6 baseline and carries these gates forward.

All disposable Android Studio AVDs and task-local host artifacts were removed after testing. The pre-existing local out and native/out trees were restored byte-for-byte, and no MuMu instance was deleted or stopped.