provisioner: initial ConfigProvisioner implementation

Core provisioner logic for PawletOS Android 16:
- BootReceiver: trigger provisioning on BOOT_COMPLETED and USER_PRESENT
- ProvisioningService: run base tasks (APN, secure settings) and OTA tasks
  (deferred APK installs) as separate passes
- VendorConfig: read vendor.cfg from partition; parse APNs, packages, settings
- Android.bp: wire up AIDL, disable resource generation (no UI)

AndroidManifest.xml

@@ -9,6 +9,7 @@
     <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
     <uses-permission android:name="android.permission.WRITE_SECURE_SETTINGS" />
     <uses-permission android:name="android.permission.CHANGE_COMPONENT_ENABLED_STATE" />
+    <uses-permission android:name="android.permission.WRITE_APN_SETTINGS" />
 
     <application
         android:allowBackup="false"
@@ -23,6 +24,7 @@
             <intent-filter android:priority="1000">
                 <action android:name="android.intent.action.LOCKED_BOOT_COMPLETED" />
                 <action android:name="android.intent.action.BOOT_COMPLETED" />
+                <action android:name="android.intent.action.USER_PRESENT" />
             </intent-filter>
         </receiver>