Initial commit: PawletCache, device-side LAN content-cache resolver

Bound service BgUpd consults before downloading component assets:
discovers a trusted cache server (mDNS and/or central lookup, policy-
configurable), verifies its signed CacheToken against a pinned root key,
and hands back a rewritten URL + TLS pin. Three-tier discovery policy
(runtime MDM override -> vendor-baked default -> compiled default).

Pairs with pawletcache-server (the LAN daemon) and BgUpd (the caller).

AndroidManifest.xml

@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+     SPDX-FileCopyrightText: oxmc / PawletOS
+     SPDX-License-Identifier: Apache-2.0
+-->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="os.pawlet.cache"
+    android:versionCode="1">
+
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
+    <uses-permission android:name="android.permission.CHANGE_WIFI_MULTICAST_STATE" />
+
+    <!-- Signature-level permission so only platform-signed callers (BgUpd,
+         and later the OTA/media resolvers) can bind IPawletCacheService. -->
+    <permission
+        android:name="pawletos.cache.permission.BIND_RESOLVER"
+        android:protectionLevel="signature" />
+
+    <application
+        android:allowBackup="false"
+        android:label="@string/app_name"
+        android:persistent="false"
+        android:supportsRtl="true">
+
+        <service
+            android:name=".PawletCacheService"
+            android:exported="true"
+            android:permission="pawletos.cache.permission.BIND_RESOLVER">
+            <intent-filter>
+                <action android:name="pawletos.cache.action.BIND" />
+            </intent-filter>
+        </service>
+
+    </application>
+
+</manifest>