Improve managed-profile provisioning checks

[Stem0794]

Follow-up to #10.

Harbor should detect when Android does not permit managed-profile provisioning before launching the provisioning flow, and explain the conflict clearly to the user.

Scope:

• Check whether ACTION_PROVISION_MANAGED_PROFILE is currently allowed before starting provisioning.
• Surface a clear unsupported-management-state message instead of launching a flow that cannot succeed.
• Cover cases where another device-management configuration (for example, an existing device owner) prevents Harbor's normal managed-profile setup.
• Keep the implementation generic; do not special-case Dhizuku.
• Preserve Harbor's use of standard Android profile-owner APIs.

This does not imply support for creating Harbor work profiles alongside unsupported device-owner configurations on modern Android; the goal is accurate detection and error handling.

[Stem0794]

Implemented and merged via PR #13. Harbor now checks whether ACTION_PROVISION_MANAGED_PROFILE is allowed before launching provisioning. The allowed Harbor → Android provisioning hand-off was validated on a disposable Android 16/API 36 AVD. The blocked-path behavior is covered by automated tests. No safe naturally blocked environment was available for physical validation, and no artificial Device Owner/Profile Owner state was created solely to force that test. The implementation remains generic and does not special-case Dhizuku.