fix: 审查阻塞修复 — SHA256 TBD占位+beta/nightly→stable+硬编码channel+路径校验

- manifest.json: beta/nightly h5.url → index-stable.html
- SHA256: TBD占位(build后push-hotfix.sh更新)
- index-stable: ver元素用channel变量, match?.[1]防御
- fetchText: 过滤..防止路径遍历

packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt

@@ -84,7 +84,8 @@ class MainActivity : AppCompatActivity() {
         /** Fetch text file from Gitea — proxy for version.txt etc */
         @android.webkit.JavascriptInterface
         fun fetchText(path: String): String {
-            val url = "https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/raw/branch/main/ota/$path"
+            val safe = path.replace("..", "").replace("\\", "/")
+            val url = "https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/raw/branch/main/ota/$safe"
             Log.i(TAG, "Bridge fetching $url")
             return try {
                 val conn = URL(url).openConnection() as HttpURLConnection