Serve only hash-verified capsule assets #171

Part of #173 (isolation plan).

The gateway serves capsule assets straight from data_dir/capsules (elastos-server/src/api/browser_capsules.rs:496-498) without checking them against the admitted package hashes. Any process running as the Runtime account, such as an unconfined provider, can rewrite Home's JavaScript and keep control across restarts.

Done means

• The gateway serves only files whose hashes match the admitted package; a changed file is refused and reported. Test: the regression test below.
• A regression test changes one Home asset on disk and proves it is not served.
• Host-side check: see Home: split into a Runtime-owned host and a sandboxed Home GUI capsule #176.
• The admitted hash set is part of the staged update: it switches together with the new release and back on Undo (test, with UP-02: Stage one complete release #108 and UP-03: Restart and recover safely #109 (0.8.0, not blocking)).
• The macOS VZ helper, which is re-signed at install, is either shipped already signed or its post-signing hash is what gets admitted (test).
• Admission binds the verified publisher and the capsule name to the complete package, not only the manifest and entrypoint (today elastos/crates/elastos-runtime/src/signature/verifier.rs:119-153 and elastos/crates/elastos-server/src/runtime.rs:359-372 cover the manifest and entrypoint only, and any trusted key is accepted for any name). Tests: a changed non-entrypoint asset is refused; a key trusted for another publisher cannot claim Home or Wallet.
• Component binaries (Kubo, FFmpeg, llama.cpp, the Browser VM image) are checked against the signed hash set when they start, not only at install. Test: a changed binary does not start. A component built on the device (llama.cpp on ARM64 Linux, components.json:1455-1457) is recorded by hash when built and checked the same way.

Browser plan reconciliation — 2026-10-08

#288 and #293 bind built/installed/served Browser capsule assets to the admitted signed generation. Repair/update and a stale served process cannot substitute assets from another generation. Existing hash-verification and tampered-asset refusal remain this issue's output, consumed alongside the complete image/helper set from #217.