SecureVaultStartup
Captures the application Context once at process start so the rest of the library can resolve it without the consumer having to pass it.
Wired into androidx.startup via the <meta-data> entry in secure-vault's AndroidManifest.xml. The Startup runtime runs every registered initializer before Application.onCreate() returns, which means SecureVaultStartup.applicationContext is set before any call site could reasonably reach it.
Consumers that intentionally disable Startup (e.g. by removing the <provider> from their manifest) must call SecureVault.initialize(context) from Application.onCreate() themselves.
Visibility is public because the class name must be reflectively loadable by the Startup runtime; the companion holder is internal.