fix(android): 安全修复 — SHA256原生层计算+TOCTOU+域名白名单

- PackageInstallerModule: DigestInputStream边写边算SHA256, 原生层校验消除TOCTOU
- updater: remove expo-crypto, add download domain whitelist, 错误消息去敏感路径
- package.json: 移除expo-crypto依赖(不再需要JS侧SHA256)

packages/client-android/package.json

@@ -14,7 +14,6 @@
     "@yuzu-gca/shared": "workspace:*",
     "expo": "~52.0.0",
     "expo-constants": "~17.0.0",
-    "expo-crypto": "~14.0.0",
     "expo-file-system": "~18.0.0",
     "expo-status-bar": "~2.0.0",
     "expo-updates": "~26.0.0",