Add signature verification metadata and policy controls

[huanfeng]

Summary

• add manifest signature metadata and signing configuration to repository manifests
• enhance bucket and repository commands with signature verification flags and trust policy handling
• verify APK hashes/signatures during repository validation with configurable strict/lenient behavior

Testing

• go test ./...

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Skipping APK verification for http/https download URLs

The new APK validation loop now immediately continues when resolveLocalAPKPath returns false (i.e., for any download URL starting with http/https). For repositories configured with a BaseURL that produces absolute download URLs, every APK will hit this branch, so checkAPKFiles skips existence/hash checks, leaves ValidFiles at 0, and still reports “no issues”. This regression means apkhub verify no longer detects missing or corrupted APKs for the common case of remote BaseURLs.

Useful? React with 👍 / 👎.