Preserve Rust extractor and add hardened Lineage incremental OTA support

[akhilnarang]

Summary

• Add a minimal, additive Lineage incremental OTA backend while preserving the existing mainline Rust extractor path.
• Pin runtime artifact provenance by SHA (Python 3.14 flow), with runtime download behavior (not bundled in the package).
• Scope is Linux x86 incremental payload support.

Attempts abandoned

• Large custom Rust/native reimplementation of Zucchini/Puffin/LZ4DIFF.
• AOSP in-process/shared-library extraction exploration/build path (rejected for safety/build complexity).
• Project-replacing pure-Python rewrite.
• Final approach here is the minimal mainline-preserving, runtime SHA-pinned Lineage backend.

Validation

• Reviewed local final tree 417442e9bb2e5236f1b0e90e9dd9ea7df2a2fc36 reproduced exactly as a single squashed commit tree.
• Branch rebased onto latest origin/mainline and force-pushed with exact lease.
• Review gates already passed: DeepSeek Max approval and Gemini High approval.

Limitations

• Runtime artifact download is required; artifacts are not vendored/bundled.
• Current backend scope is Linux x86 incremental OTA extraction.