fix(spoof): order spoofers before keystore hook

BootStateManager.apply and PatchLevelManager.initialize ran after
initializeInterceptors, so keystore2 cached ro.boot.* and
ro.build.version.security_patch from the un-spoofed values during
hook init. Move both before the interceptor so the hook sees the
spoofed snapshot. ConfigurationManager stays between them since
it only loads files and is independent of prop state.

app/src/main/java/org/matrix/TEESimulator/App.kt

@@ -42,13 +42,18 @@ object App {
 
         try {
             prepareEnvironment()
-            // Initialize and start the appropriate keystore interceptors.
-            initializeInterceptors()
+
+            // Spoof boot-state and patch-level props before any hook attaches,
+            // so keystore2's cached snapshot reflects the spoofed values.
+            BootStateManager.apply()
+            PatchLevelManager.initialize()
 
             // Load the package configuration.
             ConfigurationManager.initialize()
-            BootStateManager.apply()
-            PatchLevelManager.initialize()
+
+            // Initialize and start the appropriate keystore interceptors.
+            initializeInterceptors()
+
             // Set up the device's boot key and hash, which are crucial for attestation.
             AndroidDeviceUtils.setupBootKeyAndHash()