feat(action): require vol+ confirm to clear keys

Users reported accidentally triggering the module action button from
the root manager UI, which wiped /data/adb/tricky_store/persistent_keys
and forced every attestation-dependent app to re-enroll.

Gate the destructive operation behind an explicit Vol+ confirmation
with a 10-second timeout. Vol- or timeout aborts and preserves keys.
Pattern mirrors tricky-addon-enhanced/install_func.sh choose_automation
(getevent -qlc 1 polled per second), but defaults to cancel on timeout
because the destructive default of the previous script is the
behavior we are correcting.

module/action.sh

@@ -2,10 +2,64 @@
 MODDIR=${0%/*}
 CONFIG_DIR=/data/adb/tricky_store
 
+echo "  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "  ⚠️  Clear Persistent Key Storage"
+echo "  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo " "
+echo "  This deletes all cached attestation keys."
+echo "  Apps using attestation will re-enroll on next use."
+echo " "
+echo "  🔊  Vol+  = Confirm clear"
+echo "  🔉  Vol-  = Cancel (default after 10s)"
+echo " "
+
+confirm() {
+    vol_tmp="${TMPDIR:-/data/local/tmp}/teesim_vol_key"
+    seconds=10
+
+    : > "$vol_tmp"
+    getevent -qlc 1 > "$vol_tmp" 2>/dev/null &
+    ge_pid=$!
+
+    while [ "$seconds" -gt 0 ]; do
+        sleep 1
+        if ! kill -0 "$ge_pid" 2>/dev/null; then
+            key=$(awk '/KEY_/{print $3}' "$vol_tmp" 2>/dev/null)
+            case "$key" in
+                KEY_VOLUMEUP)
+                    rm -f "$vol_tmp"
+                    return 0
+                    ;;
+                KEY_VOLUMEDOWN)
+                    rm -f "$vol_tmp"
+                    return 1
+                    ;;
+            esac
+            : > "$vol_tmp"
+            getevent -qlc 1 > "$vol_tmp" 2>/dev/null &
+            ge_pid=$!
+        fi
+        seconds=$((seconds - 1))
+    done
+
+    kill "$ge_pid" 2>/dev/null
+    wait "$ge_pid" 2>/dev/null
+    rm -f "$vol_tmp"
+    return 1
+}
+
+if ! confirm; then
+    echo " "
+    echo "  ❌ Cancelled — keys preserved"
+    exit 0
+fi
+
 if [ -d "$CONFIG_DIR/persistent_keys" ]; then
     rm -rf "$CONFIG_DIR/persistent_keys"
     mkdir -p "$CONFIG_DIR/persistent_keys"
-    echo "Persistent key storage cleared"
+    echo " "
+    echo "  ✅ Persistent key storage cleared"
 else
-    echo "No persistent key storage found"
+    echo " "
+    echo "  ℹ️  No persistent key storage found"
 fi