android: never look up children while iterating /data/app

[mountaser]

Summary

Never look up children while iterate_dir() holds /data/app, on any kernel version: the /data/app APK scan is now two-phase everywhere.

Problem

On kernels >= 6.1, apk_outer_actor called filp_open("/data/app/~~<hash>/") from inside the iterate_dir() actor. iterate_dir() holds the /data/app i_rwsem shared, and a child lookup that misses the dcache takes it again in lookup_slow(). If a writer is already queued (an install doing mkdir), the second down_read() blocks behind it and the task deadlocks against itself; everything touching /data/app then piles up.

Seen on a Pixel 8 Pro (6.1.162 GKI) with a cold-dcache pm install loop:

task:PackageManager state:D
  rwsem_down_write_slowpath <- down_write <- filename_create <- do_mkdirat
task:apd state:D
  down_read <- path_openat <- filp_open <- [KP] <- f2fs_readdir <- iterate_dir <- ... <- supercall

This is the uid_listener / supercall refresh path, so it is independent of the rename hook (#326).

Changes

• Phase 1: the iterate_dir() actor only records ~~ names (no lookup, I/O or allocation).
• Phase 2: after iterate_dir() returns and the lock is released, open and scan each recorded directory in iteration order.
• 06887a4 limited the two-phase scan to old kernels because the collector could miss the APK: it kept at most 256 names of < 64 bytes and silently dropped the rest. The new list is packed and growable: when it fills, the actor sets an overflow flag, the caller doubles the buffer with no lock held and rescans from the start. Past 2 MiB of names the scan fails loudly with -E2BIG instead of truncating. The same list replaces the fixed array on old kernels.
• Flat pass, log lines and return codes are unchanged; the first matching ~~ directory in iteration order still wins.

Testing

Device	Build	Result
Pixel 8 Pro, 6.1.162, kCFI + SCS	without this change	wedged within minutes under the loop above (stacks above)
Pixel 8 Pro	with this change, same conditions (2 concurrent loops, cache dropped before each install)	50/50 installs completed; 69 scans, all found the manager (apk found (scramble)), including 54 uid_listener events (the apd refresh path); 0 hangs, 0 app dir scan errors
Xiaomi Mi 10, 4.19.157	with this change, 1,785 ~~ dirs (list grew 16 -> 32 -> 64 KiB) + 20 cold-cache installs	20/20 ok, 20 refreshes rc=0, 0 scan errors

• Builds with the CI toolchain (aarch64-none-elf-gcc 12.2): https://github.com/mountaser/KernelPatch/actions/runs/37581922702 (this change + android: defer packages.list rename refresh out of the rename lock #326). This branch alone compiles with 0 errors under clang; it merges cleanly with android: defer packages.list rename refresh out of the rename lock #326 and android: hook selinux_inode_rename when the rename LSM wrapper is inlined #322.
• Not covered: the failure was observed once, so the Pixel comparison is before/after on the same device, not a deterministic reproduction.