fix: 审查阻断修复 — cache加载+TBD校验+路径安全

1. 恢复cacheFile.exists()→加载缓存HTML(OTA链路修复)
2. TBD/零哈希双重拒绝(/^(0{64}|TBD)/)
3. fetchText双次替换..防止绕过
4. BUILD SUCCESSFUL

ota/h5/index-stable.html

@@ -58,7 +58,7 @@ function checkUpdate(){
  var v=h5.min_version.replace(/[^0-9]/g,''),my=(document.getElementById('ver').innerText||'').replace(/[^0-9]/g,'');
  if(parseInt(my||'0')<parseInt(v||'0')){log('ERR: APK too old (need v'+h5.min_version+')');return}
  dlUrl=h5.url;dlSha=h5.sha256||'';
- if(!dlSha||/^0{64}$/.test(dlSha)){log('ERR: channel no build');return}
+ if(!dlSha||/^(0{64}|TBD)/.test(dlSha)){log('ERR: channel no build');return}
  if(h5.latest!==document.getElementById('ver').innerText){
   dlVer=h5.latest;document.getElementById('btnApply').classList.add('show');log('*** NEW VERSION ***')}
  else log('up to date')

packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt

@@ -58,7 +58,7 @@ class MainActivity : AppCompatActivity() {
 
         @android.webkit.JavascriptInterface
         fun fetchText(path: String): String {
-            val safe = path.replace("..", "").replace("\\", "/")
+            val safe = path.replace("..", "").replace("..", "").replace("\\", "/")
             val url = "https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/raw/branch/main/ota/$safe"
             return try {
                 URL(url).openConnection().apply { connectTimeout = 10000; readTimeout = 10000 }