fix: correct zip root path and add idempotent build.prop append

- Fix ZIPROOT path from 3 to 4 levels up (../../../../)

- Add path validation before install

- Replace simple cat append with key-based dedup for build.prop (skips existing keys to prevent duplication on re-flash)

- Update AGENTS.md and README.md to reflect the changes

AGENTS.md

@@ -34,7 +34,7 @@ zip root
 
 ### Install flow (update-binary)
 
-1. Locate zip root: `dirname $0` → up 3 levels (`../../..`)
+1. Locate zip root: `dirname $0` → up 4 levels (`../../../../`)
 2. Mount `/system` and `/vendor`
 3. **Append** `system/build.prop` → `/system/build.prop` (backup first to `.bak`)
 4. Copy `goodix_ts.idc` → `/system/usr/idc/`
@@ -43,11 +43,23 @@ zip root
 
 ### Critical constraint: build.prop is APPENDED, never replaced
 
-`update-binary` line ~72: `cat "$BUILDPROP_SRC" >> /system/build.prop`
+`update-binary` now uses **key-based dedup**: each line is appended only if its
+key (`key=` before `=`) does not already exist in the target.
 
-The `>>` is intentional. Using `>` or `package_extract_dir` would clobber the
-device's existing properties. Re-flashing duplicates entries — warn the user or
-add idempotency if this becomes a problem.
+```sh
+# 去重追加：逐 key 检查，仅追加不存在的条目
+while IFS= read -r line || [ -n "$line" ]; do
+  case "$line" in
+    ''|'#'*) continue;;
+  esac
+  key="${line%%=*}"
+  if ! grep -q "^${key}=" /system/build.prop 2>/dev/null; then
+    echo "$line" >> /system/build.prop
+  fi
+done < "$BUILDPROP_SRC"
+```
+
+Re-flashing is now safe — entries are never duplicated.
 
 ## Key Files