feat(soter): sepolicy grants for ptrace injection

Injection into the soterserver app (platform_app domain, per recon)
needs ptrace under SELinux enforcing. Add the grant mirroring the
keystore one, in the base rule so it applies to both variants:

  allow crash_dump platform_app process *

The per-UID NDJSON write grant is debug-only: appended for debug
builds in build.gradle.kts's isDebug doLast, mirroring the existing
keystore media_rw_data_file grant. Keeping it out of the base rule
stops an external-storage write from leaking into release.

No soter_server SELinux type exists; platform_app is the soterserver
app domain. Runtime policy (KSU/magiskpolicy) grants this past the
compile-time neverallow; on-device avc verification is 10.V.

Checkpoint 10.C.

module/sepolicy.rule

@@ -1,6 +1,10 @@
 allow keystore {adb_data_file shell_data_file} file *
 allow crash_dump keystore process *
 
+# SOTER Layer-A (10.C): ptrace inject into soterserver (platform_app). The debug NDJSON
+# media_rw_data_file grant is debug-only — appended for debug builds in app/build.gradle.kts.
+allow crash_dump platform_app process *
+
 allow ksu self:tcp_socket { create connect read write getopt setopt }
 allow ksu node:tcp_socket node_bind
 allow ksu port:tcp_socket name_connect