check
Runs every available check and returns a combined IntegrityReport.
Does file/socket I/O, so call off the main thread.
Parameters
expected Signing Sha256
allow-list of expected app signing-cert SHA-256 hashes (:/space-separated and case-insensitive accepted). When empty, the repackaging signal is INCONCLUSIVE and only IntegrityReport.signingSha256 is surfaced for out-of-band comparison.