Fix Android App Link verification intent

docs/verification.md

@@ -2096,6 +2096,15 @@ promoted.
   certificate, with `whoneedhelp.com` in Android's verified domain state. Its
   installer is absent, so this is explicitly a sideloaded-build observation
   and not Play-delivered evidence.
+- A read-only installed-build verifier now requires the exact expected version,
+  `com.android.vending` installer, a supplied Play App Signing SHA-256 identity,
+  verified `whoneedhelp.com` domain state, and production App Link resolution to
+  `MainActivity`. The physical device confirmed that Android resolves the link
+  to `MainActivity` when both the `DEFAULT` and `BROWSABLE` intent categories
+  are supplied. A regression gate rejects an incomplete category set,
+  sideloaded installer, upload-only certificate, unverified domain, or browser
+  resolution. The current sideloaded package therefore intentionally cannot
+  satisfy the Play-delivery gate.
 - The already-authenticated Chrome dev-port instance exposed two Play Console
   pages, including the Who Need Help internal-release preparation page.
   Playwright connected to its DevTools WebSocket but could not import the 94

scripts/quality.sh

@@ -564,6 +564,11 @@ REPORT
 REPORT
     ;;
   "shell cmd package")
+    if [[ " $* " != *" -c android.intent.category.DEFAULT "* ]] ||
+      [[ " $* " != *" -c android.intent.category.BROWSABLE "* ]]; then
+      echo "App Link resolution omitted a required intent category." >&2
+      exit 1
+    fi
     printf '%s\n' "${FAKE_PLAY_ACTIVITY:-org.whoneedhelp.mobile/.MainActivity}"
     ;;
   *)

scripts/verify-play-installed-android.sh

@@ -167,6 +167,7 @@ fi
 resolved_activity=$(
   adb_device shell cmd package resolve-activity --brief \
     -a android.intent.action.VIEW \
+    -c android.intent.category.DEFAULT \
     -c android.intent.category.BROWSABLE \
     -d "$app_link_url" |
     tr -d '\r'