Fix the cross-provider review's findings on VR APK support

patch() turns corrupt-manifest struct/index errors into FrameError; a missing
layer build says so; the signing key falls back to a rename where hard links
aren't supported and explains how to recover from a bad cached key; the layer
nulls an instance it can't destroy and logs xrLocateSpaces once.

Not changed: the 1.1 Meta profile names match xr.xml's promoted names
(meta/touch_pro_controller, meta/touch_plus_controller), and grip_surface is
palm_ext renamed, so the rewrite stays (now commented).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

frame/openxr-compat/README.md

@@ -238,7 +238,7 @@ from the binary; runtime execution of those paths remains unverified.
 Prebuilt library SHA-256:
 
 ```
-aace99b7bcdb3c79fa844d75a9483f8f4b16bd6e669fb3003515df8c673ce54b
+479d31c374f137906e03f73209b581d65d7e6a41b8476e6425fa55a6aa40bd68
 ```
 
 APK SHA-256:

frame/openxr-compat/compat_logic.h

@@ -35,6 +35,7 @@ inline ExtensionPlan extensions(const Names& requested, const Names& available,
     }
     return p;
 }
+// 1.1's grip_surface is XR_EXT_palm_pose's palm_ext renamed (same pose), not the grip pose.
 inline std::string rewritePath(std::string p, bool palm) {
     const std::string suffix = "/input/grip_surface/pose";
     if (palm && (p == "/user/hand/left" + suffix || p == "/user/hand/right" + suffix))

frame/openxr-compat/layer.cpp

@@ -121,7 +121,8 @@ XrResult XRAPI_CALL destroySession(XrSession s) try {
 XrResult XRAPI_CALL locateSpaces(XrSession s, const XrSpacesLocateInfo* in, XrSpaceLocations* out) try {
     auto d = get(s); if (!d) return XR_ERROR_HANDLE_INVALID;
     if (!d->locate) return XR_ERROR_FUNCTION_UNSUPPORTED;
-    LOG("xrLocateSpaces -> xrLocateSpacesKHR (core/KHR type aliases)");
+    static std::once_flag logged;  // called every frame
+    std::call_once(logged, [] { LOG("xrLocateSpaces -> xrLocateSpacesKHR (core/KHR type aliases)"); });
     return frame::locate(d->locate, s, in, out);
 } GUARD_END
 XrResult XRAPI_CALL threadSettings(XrSession s, XrAndroidThreadTypeKHR type, uint32_t tid) try {
@@ -226,7 +227,9 @@ XrResult XRAPI_CALL createLayer(const XrInstanceCreateInfo* info, const XrApiLay
     d->gipa = next; d->instance = *instance;
     d->destroy = proc<PFN_xrDestroyInstance>(next, *instance, "xrDestroyInstance");
     // A successful runtime instance must expose xrDestroyInstance.
-    if (!d->destroy) { LOG("invalid downstream: missing xrDestroyInstance"); return XR_ERROR_INITIALIZATION_FAILED; }
+    if (!d->destroy) {  // nothing could ever destroy it, so don't hand it out
+        LOG("invalid downstream: missing xrDestroyInstance"); *instance = XR_NULL_HANDLE; return XR_ERROR_INITIALIZATION_FAILED;
+    }
     try {
         d->enabled = std::move(plan.downstream); d->stubbed = std::move(plan.stubbed);
         d->palm = frame::has(d->enabled, "XR_EXT_palm_pose");