qa: harden physical dual-app acceptance

[Harzva]

Summary

• require host-controlled background restriction, restoration, and visible MobileCore recovery for counted physical Android runs
• pin MobileCore, MobileCode, and instrumentation APK signing certificate fingerprints before installation
• document the strict physical-device and verified-Omni commands without storing prompts, credentials, media, or host paths

Verification

• python3 -m py_compile scripts/run_mobilecore_dual_app_qa.py scripts/test_run_mobilecore_dual_app_qa.py
• python3 scripts/test_run_mobilecore_dual_app_qa.py (12 passed)
• real apksigner verification passed for three freshly built controlled QA APKs
• Android 16 ARM64 emulator background-restriction/recovery lane passed
• git diff --check
• Semgrep secrets scan passed
• MobileCode pureDebug APK and AndroidTest APK built
• MobileCore debug APK built

Physical-device acceptance remains pending because no physical Android target is connected; emulator evidence is not counted as physical evidence.