fix(spoof): respect system=prop passive default

PatchLevelManager.initialize previously called updateTo, which
overwrote security_patch.txt with explicit dates and destroyed
the Phase 1 default of system=prop. Split prop application into
a new private applyToProps so initialize only resetprops; never
writes the file. BulletinPoller now treats currentPatch() == null
(the signal for system=prop or missing/blank) as passive and
skips updateTo. The file becomes user-owned config; props track
PIF or the device default.

app/src/main/java/org/matrix/TEESimulator/config/BulletinPoller.kt

@@ -101,7 +101,10 @@ object BulletinPoller {
                 )
             }
             val current = currentPatch()
-            val isNewer = current == null || date > current
+            if (current == null) {
+                return FetchResult(ts, "success", code, date, false, null)
+            }
+            val isNewer = date > current
             if (isNewer) {
                 PatchLevelManager.updateTo(date)
             }

app/src/main/java/org/matrix/TEESimulator/config/PatchLevelManager.kt

@@ -38,7 +38,18 @@ object PatchLevelManager {
                     Build.VERSION.SECURITY_PATCH,
                 )
         SystemLogger.info("PatchLevelManager: resolved patch date = $date")
-        updateTo(date)
+        applyToProps(date)
+    }
+
+    private fun applyToProps(date: String) {
+        if (!DATE_PATTERN.matches(date)) {
+            SystemLogger.warning(
+                "PatchLevelManager: skip resetprop for invalid date: $date"
+            )
+            return
+        }
+        AndroidDeviceUtils.setProperty("ro.build.version.security_patch", date)
+        AndroidDeviceUtils.setProperty("ro.vendor.build.security_patch", date)
     }
 
     fun updateTo(date: String) {
@@ -70,8 +81,7 @@ object PatchLevelManager {
             return
         }
         atomicWrite(date)
-        AndroidDeviceUtils.setProperty("ro.build.version.security_patch", date)
+        applyToProps(date)
-        AndroidDeviceUtils.setProperty("ro.vendor.build.security_patch", date)
         SystemLogger.info("PatchLevelManager: applied patch date $date")
     }