Let the phone replace itself, and give CI a channel it may sign

The Android head had no updater and no release path, and the two are one problem:
Android refuses an update signed by a different key, and CI generates a fresh debug
key in every container. An APK released from a workflow could be installed once and
never updated again — each new one an uninstall, which on this product means losing
the cache, the outbox and the device key.

So there are two channels, and they are two applications because the platform gives
no third option. dev.dodotech.dodossh is cut from a v* tag by a person running
scripts/release-android.ps1 with the key ADR 0011 rule 1 keeps off runners.
dev.dodotech.dodossh.nightly is cut from main by CI and signed with a keystore
committed here in the open — a key everybody has cannot be stolen and grants nothing
by being held, which is why putting it in CI does not touch the rule. Neither can
update the other, by construction. See ADR 0014.

The android job assumed an image with a JDK and an Android SDK on it, which is what
a GitHub runner is and what this project's is not. It now installs a JDK, fetches
Google's command-line tools, accepts the licences and installs API 36 — each a no-op
where it is already satisfied, and each cached by the persistent runner's own disk
rather than by an action that would move a quarter of a gigabyte to rebuild a
directory that never left.

The client reads a small JSON manifest beside the APK, the counterpart of
releases.win.json, and compares Android's versionCode rather than a version name:
that integer is what the platform itself uses to accept or refuse an install, so
comparing anything else would offer updates the phone then rejects. It fetches, and
then asks Android to ask — the system draws its own confirmation, and from API 26
will not draw even that until unknown sources is on for this application.

IUpdateChannel gained ApplyingEndsTheProcess. On Windows applying replaces the files
and restarts, so the shell disposes the vault first and that is what zeroes the keys.
On the phone the install is a request and the answer may be no, so disposing first
would answer "not now" with a locked keychain and every shell closed — a punishment
for declining an update.

Two measured bugs found on the way, both older than this work and both invisible to
a -getProperty check. ApplicationDisplayVersion is read by the Android targets in a
top-level PropertyGroup, so the target setting it from MinVer ran after the only
thing that reads it: every APK ever built here said versionName 1.0.0. And nothing
found so far varies the launcher name per channel — four mechanisms tried, all of
them recorded in platform-flags, none of them reaching the label the launcher shows.
The two channels share an icon name for now and are told apart by package name,
version, and what the preferences screen says.

src/DodoSSH.Client.Android/Views/PreferencesScreen.axaml

@@ -81,34 +81,77 @@
       <TextBlock Classes="body" Margin="6,12,6,0" TextAlignment="Center"
                  Text="{Binding StatusMessage}" />
 
-      <!-- ============ ◆ which build this is ============ -->
+      <!-- ============ ◆ updates ============ -->
       <!--
-        A fact, printed, in the shape ACCOUNT uses on the desktop's screen — and the same string the desktop
-        prints under UPDATES, read off the same place. It comes from the assembly's own informational
-        version, so it answers on a build run from a checkout as well as on a released one; see
-        ClientVersion.Current.
+        The phone's copy of the desktop's UPDATES section, over the same view model. What differs is the
+        last step and only the last step: pressing INSTALL hands the package to Android's own installer
+        rather than swapping files, so the platform draws a confirmation this application does not control
+        and the answer may be no. Everything before that — the timer, the quiet background pass, the loud
+        pressed one, the fetch — is shared. See AndroidUpdateChannel and ADR 0014.
 
-        It is worth a row of its own on the head that has no updater. On the desktop the version sits beside
-        a CHECK NOW that will tell you whether it is current; here it is the only answer, and it is the one
-        thing to read out when somebody asks which build is misbehaving. The sentence under it says where a
-        newer one comes from, which is ADR 0011 rule 2 in plain words: never from the server you sign in to.
+        The version is a fact, printed, in the shape ACCOUNT uses on the desktop. It comes from the
+        assembly's own informational version rather than from the updater, so it answers on a build run
+        from a checkout too; see ClientVersion.Current.
 
-        Bound through Updates, which is the shell's update view model and exists on this head too — over the
-        null channel, so it reports itself unsupported and its loop never starts. That is why there is no
-        button here rather than a disabled one. See ADR 0013.
+        The sentence about where builds come from is ADR 0011 rule 2 in plain words, and it is on the head
+        the rule was written for: no DodoSSH server will ever offer you the client, and one that does is not
+        one to trust.
       -->
-      <TextBlock Classes="section" Text="THIS BUILD" Margin="6,26,0,0" />
+      <TextBlock Classes="section" Text="UPDATES" Margin="6,26,0,0" />
 
       <Border Classes="card" Margin="0,10,0,0">
         <StackPanel Spacing="10">
           <Grid ColumnDefinitions="Auto,*">
             <TextBlock Grid.Column="0" Classes="label" Text="VERSION" VerticalAlignment="Center" />
             <TextBlock Grid.Column="1" Classes="mono" FontSize="13" Margin="10,0,0,0"
-                       HorizontalAlignment="Right" Text="{Binding Updates.CurrentVersion}" />
+                       HorizontalAlignment="Right" TextTrimming="CharacterEllipsis"
+                       Text="{Binding Updates.CurrentVersion}" />
           </Grid>
 
+          <StackPanel Spacing="10" IsVisible="{Binding Updates.IsSupported}">
+
+            <CheckBox MinHeight="44" IsChecked="{Binding Updates.IsAutomatic}">
+              <TextBlock Classes="mono" FontSize="11.5" TextWrapping="Wrap"
+                         Text="Look for newer builds on their own" />
+            </CheckBox>
+
+            <TextBlock Classes="body"
+                       Text="Checks come from the project's own release page and never from the server you sign in to. Nothing is installed without you saying so, and Android asks again in its own words before anything is replaced." />
+
+            <!--
+              The bar, copying the desktop's and the transfers screen's. Shown while fetching and not
+              before: a bar at zero beside a button nobody has pressed is a screen that looks busy.
+            -->
+            <ProgressBar IsVisible="{Binding Updates.IsDownloading}" Height="4"
+                         Minimum="0" Maximum="100" Value="{Binding Updates.DownloadPercent}" />
+
+            <Button Classes="secondary" Height="44" Content="CHECK NOW"
+                    Command="{Binding Updates.CheckNowCommand}"
+                    IsEnabled="{Binding Updates.CanCheckNow}" />
+
+            <!--
+              INSTALL rather than the desktop's RESTART NOW, and the word is the honest one: this does not
+              restart anything. It asks Android to install, and Android asks the user. What follows is the
+              system's screen, not this one.
+            -->
+            <Button Classes="primary" Height="44" Content="INSTALL"
+                    IsVisible="{Binding Updates.IsReady}"
+                    Command="{Binding Updates.RestartNowCommand}" />
+
+            <TextBlock Classes="body" IsVisible="{Binding Updates.IsReady}"
+                       Text="{Binding Updates.RestartWarning}" />
+
+            <TextBlock Classes="detail" TextWrapping="Wrap" Text="{Binding Updates.Status}"
+                       IsVisible="{Binding Updates.Status, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
+          </StackPanel>
+
+          <!--
+            The build that cannot replace itself, which on this head is one an IDE deployed or one built
+            from a checkout — see AndroidUpdateChannels.ForThisPhone. Said rather than shown as dead
+            controls, following HasNoDeviceKeyOption above.
+          -->
           <TextBlock Classes="body" IsVisible="{Binding Updates.IsUnsupported}"
-                     Text="This head does not replace itself. A newer DodoSSH is an APK from the project's own release page, installed the way this one was — and no DodoSSH server will ever offer you one, whatever it says. A server that does is not a server to trust." />
+                     Text="This build cannot replace itself — it was not installed from the project's release page. A newer DodoSSH is an APK from there, installed the way a released one would be. No DodoSSH server will ever offer you one, whatever it says; a server that does is not a server to trust." />
         </StackPanel>
       </Border>