feat(soter): sepolicy grants for ptrace injection

Injection into the soterserver app (platform_app domain, per recon)
needs ptrace under SELinux enforcing. Add the grant mirroring the
keystore one, in the base rule so it applies to both variants:

  allow crash_dump platform_app process *

The per-UID NDJSON write grant is debug-only: appended for debug
builds in build.gradle.kts's isDebug doLast, mirroring the existing
keystore media_rw_data_file grant. Keeping it out of the base rule
stops an external-storage write from leaking into release.

No soter_server SELinux type exists; platform_app is the soterserver
app domain. Runtime policy (KSU/magiskpolicy) grants this past the
compile-time neverallow; on-device avc verification is 10.V.

Checkpoint 10.C.

app/build.gradle.kts

@@ -224,10 +224,14 @@ androidComponents {
 
                 if (isDebug) {
                     doLast {
-                        // Debug-only: grant the keystore domain external-storage access; diag.sh
+                        // Debug-only: grant the keystore + soterserver (platform_app) domains
-                        // (shipped only in debug) carries the shell side of the diagnostic plane.
+                        // external-storage access for the per-UID NDJSON sink. diag.sh (shipped
+                        // only in debug) carries the shell side of the diagnostic plane.
                         tempModuleDir.get().asFile.resolve("sepolicy.rule")
-                            .appendText("\nallow keystore media_rw_data_file { dir file } *\n")
+                            .appendText(
+                                "\nallow keystore media_rw_data_file { dir file } *" +
+                                    "\nallow platform_app media_rw_data_file { dir file } *\n",
+                            )
                     }
                 }
             }

module/sepolicy.rule

@@ -1,6 +1,10 @@
 allow keystore {adb_data_file shell_data_file} file *
 allow crash_dump keystore process *
 
+# SOTER Layer-A (10.C): ptrace inject into soterserver (platform_app). The debug NDJSON
+# media_rw_data_file grant is debug-only — appended for debug builds in app/build.gradle.kts.
+allow crash_dump platform_app process *
+
 allow ksu self:tcp_socket { create connect read write getopt setopt }
 allow ksu node:tcp_socket node_bind
 allow ksu port:tcp_socket name_connect