fix(android): enforce and publish certificate transparency

[yschimke]

Summary

• route the deterministic CT fixture through Android platform trust policy with an application trust anchor
• verify enforced and opted-out behavior on API 37 and publish the observation to the TLS policy table
• preserve Android CT and ECH JSON through platform test storage instead of pulling an already-uninstalled test APK
• keep the emulator runner on current v2.38.0; the shared Renovate config already groups GitHub Actions updates

Verification

• Android compile, lint, public API, and fixture compilation checks
• complete local ARM64 Android 17 / API 37 run: CT 2/2 and controlled ECH 3/3 passing
• valid CT and ECH JSON artifacts parsed locally; site collector found the nested Android TLS policy report
• public ECH probes remain non-gating; defo.ie currently reports its externally expired certificate