[kasnder]

Fixes #975.

Problem

Apps installed on an SD card or adopted storage only become visible once the volume mounts. On boot that happens after ServiceSinkhole has built its rules, so those apps are unknown to the VPN and get no network access until the user refreshes the app list.

Change

Android announces the mount with ACTION_EXTERNAL_APPLICATIONS_AVAILABLE (and the unmount with ..._UNAVAILABLE). These broadcasts carry no data URI, so the existing package-scheme filter never matches them.

• ServiceSinkhole: register a second, scheme-less filter on packageChangedReceiver. On available, clear the rule cache, resolve any pending internet/tracker settings for the packages in EXTRA_CHANGED_PACKAGE_LIST (they could not be mapped to a UID while the volume was missing), save if changed, and reload. On unavailable, clear the cache and reload, keeping settings, since the apps are still installed.
• ActivityMain: same filter, so an open app list refreshes as well.

Testing

• Not compiled: the cloud container has no Android SDK, and Maven Central rate-limited the Gradle configuration. Needs ./gradlew :app:compileGithubDebugJavaWithJavac in CI.
• Not tested on a device. It needs someone with apps on external storage (the reporter offered) to reboot and check that those apps get network access without opening TrackerControl.

https://claude.ai/code/session_014q8SwK4eSqqhJWWVKN6VJW

---

Generated by Claude Code

[kasnder]

The instrumentation check failed in WgbridgeInstrumentedTest.tunnelStatsRebindAndStopUseRealJni with Failed to bind UDP sockets ... Address already in use (os error 98). That's in wgbridge-rs, which this PR doesn't touch, and the same test was red on master at fa4fce0. #999 fixed it on master, so I merged master into this branch (7b3f089) to pick that fix up.

---

Generated by Claude Code