feat(spoof): fill absent vbmeta complement props

invalidate_on_error, avb_version, hash_alg, and size are sibling
props of vbmeta.device_state. When device_state is present but
its complements are missing, the partial set is itself a
detection signal. Fill with safe defaults if absent; never
overwrite when present.

app/src/main/java/org/matrix/TEESimulator/config/BootStateManager.kt

@@ -13,6 +13,14 @@ object BootStateManager {
             "ro.boot.vbmeta.device_state" to "locked",
         )
 
+    private val fillIfAbsent =
+        linkedMapOf(
+            "ro.boot.vbmeta.invalidate_on_error" to "yes",
+            "ro.boot.vbmeta.avb_version" to "1.2",
+            "ro.boot.vbmeta.hash_alg" to "sha256",
+            "ro.boot.vbmeta.size" to "11904",
+        )
+
     fun apply() {
         for ((name, target) in targets) {
             val current = SystemProperties.get(name, "")
@@ -27,5 +35,14 @@ object BootStateManager {
             SystemLogger.info("BootStateManager: setting $name=$target (was: '$current')")
             AndroidDeviceUtils.setProperty(name, target)
         }
+        for ((name, value) in fillIfAbsent) {
+            val current = SystemProperties.get(name, "")
+            if (current.isNotEmpty()) {
+                SystemLogger.debug("BootStateManager: $name already '$current', skip")
+                continue
+            }
+            SystemLogger.info("BootStateManager: filling absent $name=$value")
+            AndroidDeviceUtils.setProperty(name, value)
+        }
     }
 }