reliability + security fix sprint (vc=91)

Straw full-audit fix batch (2026-07-04). Confirmed HIGH/MED findings:

- Updater self-brick: drop the fdroid.sulkta.com leaf+E7 SPKI pins (LE
  rotates the leaf every ~90d + intermediates from a pool → a routine
  renewal was guaranteed to miss both pins and silently kill the only
  in-app update path). System-CA validation + the install-time APK
  signature gate remain. Also distinguish "index unreachable" from "up to
  date", add a 30s callTimeout + bounded index read, guard the API-26
  NotificationChannel, and setOnlyAlertOnce.
- Request POST_NOTIFICATIONS at runtime so A13+ update/media notifications
  actually post (was declared but never requested → silent no-op).
- isDebuggable=false on the shipped debug variant (closes ADB run-as dump
  of watch/search history + subs; no package-id cutover).
- Crash fixes: distinctBy(url) on moreFromChannel + related (duplicate
  LazyColumn key); back-handling driven by live nav depth so it survives
  moveTaskToBack on A12+; PlaylistsStore per-store caps + off-main
  hydration (hostile import ANR); SponsorBlock staleness fence via
  NowPlaying.refreshIfCurrent.
- CacheCap.nearest() snaps up to the nearest finite cap (defaults no longer
  resolve to Unlimited/100k on fresh installs).
- RYD/SB FFI shims wrap the uniffi call (swallow a core panic per contract).
- Rust wrapper: release panic="unwind" (was "abort", which defeated UniFFI
  catch_unwind → any core panic = whole-app SIGABRT) + a 60s wall-clock
  timeout on every blocking extractor call (unblocks the caller, bounds
  thread pileup). Pairs with the strawcore-core reliability fix.

rust/strawcore/src/stream.rs

@@ -78,11 +78,10 @@ pub async fn stream_info(input: String) -> Result<StreamInfo, StrawcoreError> {
     crate::runtime::ensure_initialized();
     let video_id = resolve_video_id(&input)?;
     let video_id_for_call = video_id.clone();
-    let core = tokio::task::spawn_blocking(move || core_stream_info(&video_id_for_call))
-        .await
-        .map_err(|e| StrawcoreError::Extractor {
-            msg: format!("join: {e}"),
-        })??;
+    let core = crate::runtime::run_extract("stream_info", move || {
+        core_stream_info(&video_id_for_call)
+    })
+    .await?;
     Ok(map_stream_info(video_id, core))
 }
 
@@ -95,11 +94,10 @@ pub async fn stream_metadata(input: String) -> Result<(i64, i64), StrawcoreError
     log::info!("strawcore::stream_metadata input_len={}", input.len());
     crate::runtime::ensure_initialized();
     let video_id = resolve_video_id(&input)?;
-    let core = tokio::task::spawn_blocking(move || core_stream_metadata(&video_id))
-        .await
-        .map_err(|e| StrawcoreError::Extractor {
-            msg: format!("join: {e}"),
-        })??;
+    let core = crate::runtime::run_extract("stream_metadata", move || {
+        core_stream_metadata(&video_id)
+    })
+    .await?;
     Ok((clamp_nonneg(core.view_count), core.duration_seconds.max(0)))
 }