supply chain: add dependency verification and release provenance

[emi-ran]

Scope

Harden build dependency integrity and published APK identity.

Required behavior

• Add reviewed strict Gradle dependency verification metadata
• Consider dependency locking and repository content filters
• Verify release APK signer SHA-256 fingerprint against expected certificate
• Generate GitHub artifact attestation/provenance and document verification command
• Keep external Actions pinned to full commit SHA

Evidence

• settings.gradle.kts:15-20
• gradle/libs.versions.toml
• .github/workflows/release.yml:73-100
• gradle/verification-metadata.xml currently absent

Tests

Tampered dependency fails before compilation; wrong signing key blocks publish; gh attestation verify succeeds for released APK.

Audit: 0a39f7e.