Initial commit: PawletCache, device-side LAN content-cache resolver

Bound service BgUpd consults before downloading component assets:
discovers a trusted cache server (mDNS and/or central lookup, policy-
configurable), verifies its signed CacheToken against a pinned root key,
and hands back a rewritten URL + TLS pin. Three-tier discovery policy
(runtime MDM override -> vendor-baked default -> compiled default).

Pairs with pawletcache-server (the LAN daemon) and BgUpd (the caller).

res/values/strings.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+     SPDX-FileCopyrightText: oxmc / PawletOS
+     SPDX-License-Identifier: Apache-2.0
+-->
+<resources>
+    <string name="app_name">PawletOS Content Cache</string>
+</resources>