Strip REQUEST_INSTALL_PACKAGES from F-Droid build via workflow

The F-Droid APK is the free flavor, not the offline flavor, so the
offline manifest override is not the right place for this. Instead,
create-release.yml now runs a sed step before assembleRelease to
remove the REQUEST_INSTALL_PACKAGES permission line from the main
manifest. The zapstore builds (which need the permission for the
self-updater) are not produced by this workflow and remain unaffected.

Also reverts the offline manifest back to its original state.

https://claude.ai/code/session_01NmFcCFmEbY7NMradkEU5bv

.github/workflows/create-release.yml

@@ -29,6 +29,10 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-gradle-
 
+      - name: Remove self-update permission for F-Droid build
+        run: |
+          sed -i '/android.permission.REQUEST_INSTALL_PACKAGES/d' app/src/main/AndroidManifest.xml
+
       - name: Build APK
         run: ./gradlew assembleRelease --stacktrace
 

app/src/offline/AndroidManifest.xml

@@ -2,11 +2,10 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:tools="http://schemas.android.com/tools">
 
-    <!-- Explicitly remove network/install permissions — offline flavor has no network stack -->
+    <!-- Explicitly remove INTERNET permission — offline flavor has no network stack -->
     <uses-permission android:name="android.permission.INTERNET" tools:node="remove" />
     <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" tools:node="remove" />
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" tools:node="remove" />
-    <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" tools:node="remove" />
 
     <application
         android:name=".Amber"