fix(updater): harden APK recovery and retry flows

[papi-ux]

Summary

• download APKs through transaction-owned partial and final paths with atomic commit
• serialize complete installer transactions and reject duplicate launches before a second download starts
• clean partial/final artifacts across I/O failure, validation failure, cancellation, and post-rename cancellation
• preserve retry only for transient failures while keeping validation and safety failures blocked
• record automatic-check throttling only after successful checks
• centralize lifecycle-safe result dialogs for both updater entry points

Security and recovery

• require canonical GitHub release-asset URLs for papi-ux/nova
• reject credentials, query, fragment, wrong authority, extra segments, and raw encoded dot/slash/backslash octets before OkHttp canonicalization
• preserve UUID-owned installer targets so later downloads cannot replace an issued FileProvider URI
• retain package, version, and installed-signer validation
• keep unknown-sources permission and installation as explicit user actions; no auto-install or artifact-digest claim

Test plan

• focused recovery suite — 18/18 in both variants
• :app:testRootDebugUnitTest — 775/775
• :app:testNonRoot_gameDebugUnitTest — 769/769
• root and non-root lint complete with zero changed-hunk findings
• ARM64, ARMv7, and x86_64 debug APKs assembled
• RED→GREEN exact encoded-dot canonicalization bypass regression
• cancellation, cleanup, retry, throttle, lifecycle, and guard-release mutation probes rejected
• independent behavioral test-contract review PASS
• final production/security review PASS