[BUG] Android 16: UserService fails to start on 13.6.0 ('Found multiple conflicting per-domain rules'), works on 13.5.4

Summary: On Android 16, Shizuku 13.6.0 fails to start an app's UserService; the same app APK works on 13.5.4. The target app's Application cannot be instantiated.

Environment

• Shizuku: 13.6.0.r1086 (official GitHub release), mode adb
• Android 16 / HyperOS V816
• Device: Redmi K70 Ultra (2407FRK8EC), arm64-v8a, no root, not a virtual environment
• Client: io.deepseekharness.mobile 0.3.5, which uses a Shizuku UserService (DeviceShellUserService)

What happens

Shizuku receives the request and starts the app_process, but Android aborts while instantiating the target app's Application:

W ShizukuServiceStarter: unable to start service io.deepseekharness.mobile/io.deepseekharness.mobile.shizuku.DeviceShellUserService
W ShizukuServiceStarter: Caused by: java.lang.RuntimeException: Unable to instantiate application android.app.Application package io.deepseekharness.mobile:
W ShizukuServiceStarter: Caused by: java.lang.RuntimeException: Found multiple conflicting per-domain rules
W ShizukuServiceStarter:     at android.security.net.config.NetworkSecurityConfigProvider.handleNewApplication(NetworkSecurityConfigProvider.java:67)
W ShizukuServiceStarter:     at android.app.LoadedApk.makeApplicationInner(LoadedApk.java:1588)
I io.deepseekharness.mobile:device_shell: System.exit called, status: 1

Then UserServiceRecord: Service record ... is not started in 30000 ms, and the client reports "not connected".

A/B result (only Shizuku version changed)

Same device, same app APK, same permissions:

So this looks like a regression introduced in 13.6.0 rather than an app-side problem. My guess is the way 13.6.0 prepares/starts the UserService process makes the target app's NetworkSecurityConfig get parsed twice, and Android 16 rejects the second parse as "multiple conflicting per-domain rules".

Workaround (verified on this device)

Downgrade to Shizuku 13.5.4 — release builds cannot be downgraded in place (INSTALL_FAILED_VERSION_DOWNGRADE), so uninstall + reinstall and re-grant permission. Full logcat available on request.

Related: #1171 (same device model, 13.6.0 regression, different symptom).