0.2.4: the trustlet comes from the active slot, unpinned, and a refusal says why

0.2.3's manifest pinned the sha256 of one Android build's focal64
(16.82.0, the build the dev phone runs). Fairphone re-signs the trustlet
every release, so that pin matched exactly one of the six builds seen,
and two of two field reports had no sensor: one user on 16.100.0 edited
the manifest by hand, another ended up with a file QTEE refuses.

The manifest now carries '-' instead of a hash and depends on
fp6-vendor-blobs 1-r3, which tries the active slot first and verifies the
image's structure; QTEE's signature check is the gate it always was (one
flipped byte -> ERROR_ELF_SIGNATURE_ERROR, measured 2026-09-03 and again
today).

post-install reassembles the trustlet right away, so 'apk add' no longer
needs a boot for it. post-upgrade re-derives it from the active slot,
which replaces a hand-placed or wrongly pinned file, and then restarts
the daemon -- a plain restart, so a daemon that exited on a refused
trustlet comes back up on the re-derived one.

loadFromBuffer failures name the loader's verdict. The field's first
report was a bare result=12; it now reads ERROR_ELF_SIGNATURE_ERROR with
what to do about it. Probed on the phone with this build: a one-byte
tampered image and 100000 random bytes both print it, the pristine image
loads, and the suites pass 8/8.

packaging/APKBUILD

@@ -10,7 +10,7 @@
 # Alpine, so an APKBUILD that compiled from source could not be built by
 # anyone but us either.
 pkgname=fingerprintd
-pkgver=0.2.3
+pkgver=0.2.4
 pkgrel=0
 pkgdesc="Fingerprint daemon for the Fairphone 6 (FocalTech FT9391 behind QTEE)"
 url="https://forgejo.catcrafts.net/Catcrafts/fingerprintd"
@@ -30,10 +30,12 @@ license="GPL-3.0-only"
 # trustlet out of the stock modem partition on first boot. Without it there is
 # no matcher and the unit stays inert on its ConditionPathExists -- so this is
 # a real dependency, not a nicety. It is an FP6 device package; so is this.
-# The mbn directive the fragment uses arrived in 1-r2; the extractor before it
-# exits on an unknown directive, which on a first boot would fail the blobs
-# unit after the audio fragment had run and before this one could.
-depends="dbus glib libc++ fprintd-pam fp6-vendor-blobs>=1-r2"
+# The mbn directive the fragment uses arrived in 1-r2; the unpinned form
+# ('-' as the sha256, active slot first) and --refresh arrived in 1-r3. An
+# older extractor would read '-' as a hash and refuse every image, which on a
+# first boot fails the blobs unit after the audio fragment ran and before
+# this one could.
+depends="dbus glib libc++ fprintd-pam fp6-vendor-blobs>=1-r3"
 # The versioned provides both satisfies plasma-workspace's fprintd dependency
 # — its Users KCM is the fingerprint enrolment UI and speaks exactly this bus
 # name — and EXCLUDES the real package, which is required rather than tidy:
@@ -55,9 +57,11 @@ subpackages="$pkgname-agent $pkgname-systemd"
 # traced against an x86_64 build host
 options="!check !tracedeps"
 source="fingerprintd-$pkgver.tar.gz"
-# apk swaps the binary on disk and leaves the running daemon alone; the
-# script restarts it so an upgrade does not leave the old code answering.
-install="$pkgname.post-upgrade"
+# post-install: reassemble the trustlet now, so a fresh 'apk add' has a sensor
+# without waiting for a boot. post-upgrade: re-derive it from the active slot
+# (heals a hand-placed or wrongly pinned file), then restart the daemon --
+# apk swaps the binary on disk and leaves the running one alone.
+install="$pkgname.post-install $pkgname.post-upgrade"
 
 package() {
 	cd "$srcdir/fingerprintd-$pkgver"