ci: automate Android verification and releases

[Tim-1e]

What

• add Android CI for pull requests and main pushes
• pin the Java, Flutter, checkout, and artifact actions to exact commits
• run Flutter tests and static analysis before producing a short-lived Debug APK artifact
• add a guarded Android release workflow for vX.Y.Z tags and manual dispatches from main
• restore the signing keystore only from four encrypted secrets
• verify the historical certificate fingerprint before building and verify the final APK again before publication
• publish the APK plus SHA-256 checksum through a draft-first GitHub Release flow
• document the difference between a public certificate fingerprint and the private signing key

Why

The repository had no GitHub Actions workflows, no signing secrets, and the old Vercel deployment only built the legacy web application. A certificate fingerprint can verify a signing key but cannot sign an APK. This workflow makes regular verification automatic now and makes v2.3.6 publication one-step once the original keystore is placed in the protected release environment.

Security

The release job fails before building if any secret is missing. It accepts only the certificate SHA-256 7CE270503976BA420800C44C3E7DC8A8D7B305FBA8C515074ED0EBC9D79F4AA6, exposes signing material only to the release environment, uses least-privilege workflow permissions, and deletes the temporary keystore even after failure.

Required environment secrets:

• MARCHKOV_KEYSTORE_BASE64
• MARCHKOV_KEYSTORE_PASSWORD
• MARCHKOV_KEY_ALIAS
• MARCHKOV_KEY_PASSWORD

Verification

• actionlint 1.7.12 — both workflow files valid
• flutter test --no-pub — 16 tests passed
• flutter analyze --no-pub --no-fatal-infos — successful; two pre-existing deprecation infos only
• git diff --check — clean