0.2.4: the trustlet comes from the active slot, unpinned, and a refusal says why

0.2.3's manifest pinned the sha256 of one Android build's focal64
(16.82.0, the build the dev phone runs). Fairphone re-signs the trustlet
every release, so that pin matched exactly one of the six builds seen,
and two of two field reports had no sensor: one user on 16.100.0 edited
the manifest by hand, another ended up with a file QTEE refuses.

The manifest now carries '-' instead of a hash and depends on
fp6-vendor-blobs 1-r3, which tries the active slot first and verifies the
image's structure; QTEE's signature check is the gate it always was (one
flipped byte -> ERROR_ELF_SIGNATURE_ERROR, measured 2026-09-03 and again
today).

post-install reassembles the trustlet right away, so 'apk add' no longer
needs a boot for it. post-upgrade re-derives it from the active slot,
which replaces a hand-placed or wrongly pinned file, and then restarts
the daemon -- a plain restart, so a daemon that exited on a refused
trustlet comes back up on the re-derived one.

loadFromBuffer failures name the loader's verdict. The field's first
report was a bare result=12; it now reads ERROR_ELF_SIGNATURE_ERROR with
what to do about it. Probed on the phone with this build: a one-byte
tampered image and 100000 random bytes both print it, the pristine image
loads, and the suites pass 8/8.

packaging/20-focal64.manifest

@@ -6,7 +6,15 @@
 # there is no version of this that is our own code.
 #
 # Not one file: image/focal64.mdt plus focal64.b00..b08, placed at each ELF
-# segment's p_offset. Slot A first, slot B as fallback. The sha256 is of the
-# reassembled image and is the one QTEE has actually accepted since
-# 2026-08-24.
-mbn modem_a,modem_b image focal64 /usr/lib/firmware/focal64.mbn 1930c490d67e6f006ec346d3bee9f73d812bc0b7374bfc112873dc97ebb6cd68
+# segment's p_offset. The extractor tries the ACTIVE slot first (its TZ is
+# the one running) and the other slot as fallback.
+#
+# No sha256 pin ('-'): Fairphone re-signs this trustlet every Android
+# release, so a whole-image hash matches exactly one build - six builds, six
+# hashes, one trustlet - and the pin 0.2.3 shipped (16.82.0's) left every
+# unit on another build without a sensor (two of two field reports,
+# 2026-09-11). The extractor verifies the structure; QTEE verifies the
+# signature and refuses a damaged or foreign image (one flipped byte ->
+# ERROR_ELF_SIGNATURE_ERROR, measured 2026-09-03), and the daemon names that
+# verdict in its log.
+mbn modem_a,modem_b image focal64 /usr/lib/firmware/focal64.mbn -