fix: include USB device permission in Profile ACLs

[guantw]

Changes

• include ohos.permission.READ_WRITE_USB_DEV in the Profile ACL allowlist
• make the permission extraction regression test deterministic
• update release download, checksum, CLI, and external-agent guidance
• document the user-visible ACL behavior in the changelog

Validation

• python -m ruff format --check .
• python -m ruff check .
• python -m pytest tests/test_pipeline.py -q (59 passed)
• python -m pytest -q (297 passed, 2 skipped)
• git diff --check
• New logic has an account- and device-independent regression test
• User-visible behavior is documented in CHANGELOG.md
• No token, certificate, private key, UDID, HAP, log, or local configuration is included
• Release asset names and publisher-signing metadata were checked against the live GitHub Release
• python -m pytest --cov (the available local test environment does not include pytest-cov; GitHub Actions runs the coverage command)

Manual testing

• Confirmed the API 23 SDK defines READ_WRITE_USB_DEV as system_basic with provisionEnable=true.
• No signing materials were refreshed and no HAP was installed during this review.