Integrate T56 cellular policy and secure updater - #14

What changed

Integrates Issue #11 T56 cellular policy provisioning with Issue #12's secure existing-device updater on versionCode 3070301.

• adds the exact T56-only CELLULAR_POLICY_V1_T56 migration and truthful WARN handling
• adds signed, allowlisted existing-device update bundles with exact package/version/signer binding
• preserves Device ID, config, selected channel, LKG and safe-settings evidence
• adds non-creating legacy readiness proof, recovery, cross-ADB-port reboot correlation and sanitized reports
• includes the cellular helper/docs in the exact release-bundle allowlist

Why

Already-provisioned radios need an in-place update path that cannot silently clear identity/configuration or claim unsupported modem/APN readiness. Physical T56 testing also showed the firmware may return on the alternate local ADB server after reboot, so re-identification must scan both reviewed ports while still requiring exact app identity correlation.

Validation

• PowerShell 5.1 AST
• updater policy/fixture/state-machine tests: 31 passed
• managed cellular policy verifier
• :app:testFossDebugUnitTest, :app:assembleFossDebug, :app:assembleFossRelease
• workflow YAML/Bash signer checks, exact bundle allowlist/checksum/security fixtures
• E7ROW7 debug-channel physical acceptance:
  • ReportOnly WARN, LEGACY_READY_UI, ID E7ROW7, config 16, Ready, no mutation
  • in-place 3070300 → 3070301 installed with same sole debug signer
  • cellular migration ALREADY_OK; APN unavailable/no route remains truthful WARN
  • first reboot returned on ADB 5041 rather than 5037, exposing and fixing cross-port correlation
  • exact rerun PASS: APK_VERSION=ALREADY_OK, same-ID Ready after reboot, config 16, expanded preservation evidence

Scope and limitations

This is a preliminary integration candidate. It has not been tagged or published as a stable release. E7ROW7 acceptance is same-debug-signer evidence only; it does not waive Android's signing-key boundary or authorize a release-signed install over the debug build. T99/RYKS physical updater acceptance and protected Release signing/provenance remain separate gates.

Closes neither #6, #11 nor #12 automatically; issue scope/results should be reviewed after CI and PR review.