fix: restore Signal v8.28.2 materialisation and validate both releases

[purpleempress]

Root cause

Signal v8.28.2 inserted the systemBarsCompat import into the context of the Material You patch. Direct git am therefore rejected MainActivity.kt before compilation (tracker run 35310749623).

Repair

• Reconstruct the feature commit on v8.28.2 and regenerate patch 0001 using the exporter, preserving author, date, message and DCO provenance.
• Anchor the colorAttribute replacement outside the changed upstream import context. Keep all compatible-insets changes and downstream theme behavior; the patch still applies to the published v8.28.0 pin.
• Add a color-resolver source regression check and extend the existing unsigned PR validator to build/test both pinned and v8.28.2 releases, with separate artifacts and the existing pinned check name preserved.

Local validation

• Exact v8.28.2 materialisation failure reproduced before repair.
• Import contract observed failing before repair and passing afterward.
• Fresh materialisation succeeds for both v8.28.0 and v8.28.2; 5 theme contracts pass on each.
• Candidate regenerated tree matches the repaired source tree exactly.
• 41 exporter tests pass; source-color transform checks, actionlint and diff whitespace checks pass.

Remote Android unit tests and full release APK assembly are being run by this PR. No merge, signing, publication, or upstream.pin advance is included.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-18T22:26:05.020748Z	a5ba176	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[purpleempress]

Verification complete for a5ba176.

Passing run: https://github.com/ambr-s/vesper-android/actions/runs/35401391110

Both Signal pinned release (v8.28.0) and Signal v8.28.2 completed successfully, including fresh materialisation, 41 exporter tests, 5 theme source contracts, VesperSettingsValuesTest, EditProfileActivityThemeLifecycleTest, full assembleWebsiteProdRelease, and unsigned universal APK uploads.

Downloaded the candidate artifact and verified ZIP integrity, package systems.amber.vesper, version 8.28.2 (175301), and all four ABIs. APK SHA-256: a283d181b9797c0498389998df3da396ab07aac2074e666ae6b3936238cf6a83.

Each check has one compiler warning: [dep-ann] deprecated item is not annotated with @Deprecated; neither has a runtime-deprecation annotation or failure. Patch author/date/subject/body/sign-off provenance is unchanged. Publication pin remains v8.28.0; nothing has been merged, signed or published.