Harden provisioning and add per-app cross-profile access

[Stem0794]

Summary

• add a typed, fail-closed managed-profile provisioning preflight using the public DevicePolicyManager capability API
• re-check provisioning immediately before launching Android setup and keep existing ready-profile behavior unchanged
• add Android 11+ per-app cross-profile eligibility controls using the public profile-owner allowlist APIs
• preserve unrelated allowlist entries and leave final consent to Android
• serialize action-sheet policy mutations so cross-profile access cannot race Freeze or Unfreeze
• keep Android 10 unsupported without hidden APIs, Shizuku, or new permissions
• update compatibility and threat-model documentation

Validation

• ./gradlew --no-daemon testDebugUnitTest lintDebug assembleRelease generateSbom
• focused core policy and app unit tests
• focused core policy and app lint
• scripts/verify-manifest.sh against the release APK
• scripts/verify-deterministic-build.sh
• git diff --check
• deterministic unsigned APK SHA-256: 154a39b4edffc20496f9c0ee64eddfba3a3248dbf3fc9df9698e839f14a3e97f
• GitHub verify and deterministic checks pass for 74e05197b5c057d3ee7ea3ff4bd445c6cd3881aa

Physical and disposable-environment checks

Samsung Galaxy S24 (completed separately)

• Android 16/API 36, existing Harbor managed profile, Harbor remained Profile Owner after the signed update
• Cross-profile access was off by default for a normal Work app
• Enabling and disabling access round-tripped through Android's profile-owner allowlist
• An unrelated allowlist entry was preserved while the selected package was removed
• Freeze/Unfreeze and Cross-profile actions were exercised sequentially; final policy state was restored
• No root, hidden API, direct shell policy mutation, user/profile deletion, or factory reset was used

This run intentionally did not repeat the completed Cross-profile validation.

Provisioning

• Allowed provisioning: PASS for Harbor hand-off on a disposable API 36 AVD (sdk_gphone64_arm64, Android 16/API 36). From a clean owner user with no device/profile owner, Harbor displayed Create Work space; tapping it passed Harbor's public-API preflight and launched Android's normal com.android.managedprovisioning/.preprovisioning.PreProvisioningActivity flow. Android then stopped at its native Can't set up device screen because the Google managed-provisioning role-holder update failed offline (Update failed and offline provisioning is not allowed); no Harbor exception or policy mutation was observed.
• Post-failure state: the AVD remained encrypted, user 0 only, no owners, Device managed: false, and Can have profile: true. Harbor returned to its normal setup screen and still offered Create Work space.
• Blocked provisioning: NOT TESTED. No safe natural blocked state was available. The disposable AVD had no owner/profile and continued to report profile capacity; manufacturing a blocked state would require prohibited owner/profile mutation or destructive profile changes.
• Disposable AVD setup: API 36 google_apis;arm64-v8a on the arm64 host; only emulator and that API 36 system image were added, with the already-present android-sdk-license and android-sdk-arm-dbt-license accepted. The physical S24 was not touched during this run.

Issue readiness

• Improve managed-profile provisioning checks #11 is ready to close once PR Harden provisioning and add per-app cross-profile access #13 is merged. The allowed provisioning hand-off is verified on the disposable API 36 AVD, and the blocked preflight behavior is covered by automated tests. No safe natural blocked environment was available for physical validation, and no artificial Device Owner or Profile Owner state was created solely for testing. Note this physical validation limitation in the Improve managed-profile provisioning checks #11 closing comment.
• Can't connect MicroG to work profile #8 generic policy support is implemented; keep it open until a device with microG installed in both profiles confirms the Android consent flow.
• Reproducible builds #9 remains open because independent reproduction of a real tagged release and F-Droid acceptance are still required.