App 2.19.5: the installer screen fallback reads the APK

The car refuses the silent session for a non-system app; the fallback
installer screen could not read our FileProvider URI because grants
from the system user are refused. The car build now hands it a file
URI to the verified copy in Downloads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6

SPECS.md

@@ -118,6 +118,14 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
   confirmed car facts, app structure, UI conventions, build/test/ship, documents. It replaces
   upstream's EVABRPUploader text. The test emulator is now in the flake: `nix run .#car-emulator`
   (Android 9 AOSP at 1920×720, 160 dpi; the car build installs as the system user — checked).
+- 2026-10-23 — App 2.19.5: installing from USB (and over the air) works on the car again, with a
+  confirmation. The update log showed the car refusing the silent session: `Not allowed to install
+  non-system apps on internal storage`. The fallback, Android's installer screen, then said "There
+  was a problem parsing the package": as the system user, our FileProvider's read grant to the
+  installer is refused (`not exported from UID 1000`). The car build now hands the installer a
+  file URI to the verified copy in Downloads (StrictMode's file-URI check lifted for that one
+  call). On the emulator, with the session forced to fail as on the car, the installer screen
+  asked to update and installed it. Not tried on the car yet. OTA.md updated.
 - 2026-10-23 — App 2.19.4: "Export CarPlay data" on the Logs tab (Foreground apps card), for the
   question whether CarPlay's resolution can change. CarPlay with policy_control still leaves a grey
   strip, also after reconnecting: Allgo announces a smaller picture to the iPhone. 20 s after the