Harden the APK reader and build downloads after review

- frame_apk: android: attributes win over same-named attributes in
  other namespaces; string attributes that keep only a typed value (no
  raw string) still resolve; a failed icon read leaves the icon out
  instead of failing the install.
- The clipboard IPC origin check can't throw on odd frame URLs.
- fetch-deps.js: 60 s download timeout, at most 5 redirects, a SystemRoot
  fallback for tar.exe, and prunes pydoc_data, venv and the static
  libpython.
- Docs keep the clipboard-tool note for running the UI in a browser.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

app/main.js

@@ -234,7 +234,10 @@ async function firstRunCheck() {
 }
 
 ipcMain.handle("clipboard:read", (e) => {
-  if (!win || e.sender !== win.webContents || !url || new URL(e.senderFrame.url).origin !== new URL(url).origin) return "";
+  if (!win || e.sender !== win.webContents || !url) return "";
+  try {
+    if (new URL(e.senderFrame.url).origin !== new URL(url).origin) return "";
+  } catch { return ""; }
   return clipboard.readText();
 });