Verify www update artifacts

[3em0]

Summary

• require full www component metadata before network updates
• verify downloaded www.zip SHA-256 before extraction and install
• reject unsafe zip entries that escape the staging directory
• persist www_version only after a verified update succeeds

Closes #140

Testing

• git diff --check
• Not run: ./gradlew :app:testDebugUnitTest --tests com.openclaw.android.ArtifactSecurityTest, ./gradlew :app:ktlintCheck, ./gradlew :app:detekt (this environment has no Java/JDK: JAVA_HOME is not set and no java command is available)