Fix the cross-provider review's findings on VR APK support

patch() turns corrupt-manifest struct/index errors into FrameError; a missing
layer build says so; the signing key falls back to a rename where hard links
aren't supported and explains how to recover from a bad cached key; the layer
nulls an instance it can't destroy and logs xrLocateSpaces once.

Not changed: the 1.1 Meta profile names match xr.xml's promoted names
(meta/touch_pro_controller, meta/touch_plus_controller), and grip_surface is
palm_ext renamed, so the rewrite stays (now commented).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ui/frame_apk_sign.py

@@ -126,15 +126,20 @@ def signing_key(path=None):
                 f.flush()
                 os.fsync(f.fileno())
             try:
-                os.link(tmp, path)
+                os.link(tmp, path)  # never replaces a key another process wrote first
             except FileExistsError:
                 pass
+            except OSError:  # no hard links (FAT/exFAT): plain rename
+                if not path.exists():
+                    os.replace(tmp, path)
         finally:
-            os.unlink(tmp)
-    os.chmod(path, 0o600)
+            if os.path.exists(tmp):
+                os.unlink(tmp)
+    os.chmod(path, 0o600)  # Windows ignores this; the per-user app-data folder is the protection there
     key = json.loads(path.read_text())
     if key['n'].bit_length() != 2048 or key['e'] != 65537:
-        raise ValueError('invalid cached APK signing key')
+        raise ValueError(f'invalid cached APK signing key; delete {path} to make a new one '
+                         '(re-signed apps then need reinstalling)')
     rsa_verify(b'key check', rsa_sign(b'key check', key), key['n'], key['e'])
     return key