Add Android Binder dispatch, platform/linux+platform/android split, and PawletOS content-cache support

- VesperProfileBinderService + main_android.cpp: real Android AIDL Binder
  service backing IVesperProfileService, wired into Android.bp's srcs
  (previously declared but never implemented).
- SignatureVerifier: real CMS verification on Android too, via a vendored
  static OpenSSL (see third_party/openssl-android/README.md) since
  BoringSSL has no CMS/PKCS#7 support.
- ProfileStore: Android-appropriate data paths.
- Every payload handler split into src/platform/<Name>.h (shared contract)
  + src/platform/linux/<Name>.cpp + src/platform/android/<Name>.cpp, so the
  build system picks the platform instead of #ifdef. Android side is an
  honest "not implemented yet" stub per handler, logged rather than silent.
- content-cache payload + handler: PawletOS-fork-specific, talks to
  PawletCache/pawletcache-server. Not part of vesperprofiled's own
  upstream default.

src/platform/linux/Cert.cpp

@@ -0,0 +1,48 @@
+#include "../Cert.h"
+#include "../../payloads/PayloadUtil.h"
+
+#include <fstream>
+#include <syslog.h>
+#include <unistd.h>
+
+// ═══════════════════════════════════════════════════════════════════════════
+//  CERTIFICATE HANDLER (Linux)
+//  Root/intermediate CAs → /usr/local/share/ca-certificates/vesperos/
+//                          + update-ca-certificates
+// ═══════════════════════════════════════════════════════════════════════════
+
+namespace vesperos::profile::platform::cert {
+
+using namespace vesperos::profile::util;
+
+namespace {
+constexpr const char* kCaDir = "/usr/local/share/ca-certificates/vesperos";
+}
+
+bool apply(const ParsedPayload& p) {
+    std::string b64 = field(p, "data");
+    if (b64.empty()) { syslog(LOG_ERR, "[cert] no data"); return false; }
+
+    auto bytes = b64decode(b64);
+    if (bytes.empty()) { syslog(LOG_ERR, "[cert] bad base64"); return false; }
+
+    ensureDir(kCaDir);
+    std::string certPath = std::string(kCaDir) + "/" + p.uuid + ".crt";
+
+    {
+        std::ofstream f(certPath, std::ios::binary);
+        f.write(reinterpret_cast<const char*>(bytes.data()), bytes.size());
+    }
+    ::chmod(certPath.c_str(), 0644);
+
+    bool ok = runCmd("update-ca-certificates --fresh 2>/dev/null");
+    syslog(LOG_INFO, "[cert] installed CA cert uuid=%s", p.uuid.c_str());
+    return ok;
+}
+
+void revert(const ParsedPayload& p) {
+    removeFile(std::string(kCaDir) + "/" + p.uuid + ".crt");
+    runCmd("update-ca-certificates --fresh 2>/dev/null");
+}
+
+} // namespace vesperos::profile::platform::cert