NetControl v2.8

Lay out for foldables and tablets, keep state across config changes

On a 7.6in foldable profile the list ran edge to edge at 674dp portrait and
841dp landscape, leaving a long dead gap between each label and its switch,
and in landscape the header ate a third of the height for five visible rows.

Add a screen_gutter dimension that is 0dp by default and grows at w600dp,
w720dp and w840dp, so the content column centres on wide screens. Tighten
card padding and header spacing in values-land, which recovers a row.

Separately, folding or rotating recreates the Activity while the process
lives on, so every row lost its verified state and the green "enforced"
lines disappeared until the user re-ran Verify. Auto re-apply did not
restore them either, since it is gated to once per process. Cache state and
detail per package in static maps and restore them when the list reloads.

NetControl v2.7

Sign releases with a stable key

Every CI run was generating a fresh debug keystore, so no two releases
shared a signing certificate (v1.2 was f8e0b59c..., v1.6 was 8e13ae3c...).
Android refuses an in place install across different keys, which meant each
update required an uninstall, and an uninstall wipes SharedPreferences,
which is where the blocked app list lives. Updating cost you your blocks.

Build release variants signed with a keystore decoded from repository
secrets, and fail the workflow outright if the secret is missing rather
than quietly publishing an unsignable build. The job prints the signer
certificate and deletes the keystore from the runner afterwards.

versionCode now comes from the run number so each release can update the
one before it. R8 stays off because MainActivity reaches
Shizuku.newProcess by reflection and renaming would break it.

Signing material is gitignored. Documented the one remaining uninstall
needed to move off the old debug keys, and Obtainium for updates, since
adding an in app updater would mean giving a firewall app INTERNET and
REQUEST_INSTALL_PACKAGES.

NetControl v1.6

Fix kernel state parsing, document verified behaviour, add screenshots

Verified the whole mechanism on an Android 16 emulator with Shizuku started
over ADB, which exposed a real bug: queryState() looked for the words
"true"/"false", but the commands actually print "<package>:deny" and
"<package>:allow". Every row would have reported "Could not read state"
even when the block had worked. Parse the token after the last colon
instead.

Also check get-chain3-enabled during verification, since a deny bit is
inert while the chain is disabled and should not be reported as enforced.
The chain reports "chain:enabled" or "chain:disabled", and "disabled"
contains "enabled" as a substring, so that is matched as a token too.

Measured facts now in the README: the subcommands do not exist before
Android 15, so the previous "Android 13+" claim was wrong. Blocks do
survive killing Shizuku, do not survive a reboot, and are restored
automatically on next launch. A blocked browser really does lose network
while the device itself still has it.

Screenshots are from that emulator run.