Build the tag's APK in CI without the upload key

[ialakey]

The release workflow kept the upload keystore in four repository secrets and
signed with it. That is a lot of blast radius for what CI is for: a compromised
runner, or a workflow edited in a pull request, walks off with the key that
identifies this app on Play — and once the listing exists, that key cannot be
rotated.

What CI does now

A v* tag builds only the APK, with no android/key.properties, so Gradle
falls back to the debug signing config it already has for that case. No secrets
are read.

• The signature check is inverted. The workflow now requires the Android
  debug certificate: a real one on a runner would mean the key had leaked.
• The tag is checked against pubspec.yaml. v2.0.0 must be 2.0.0, and
  the build is passed that versionName/versionCode explicitly, so a tag can
  never claim a version the artifact does not carry.
• The artifact is srbguide-<version>-debug-signed.apk with its SHA-256, and
  the draft release states plainly what it is: sideload and QA only. Every run
  generates its own debug key, so two CI builds do not update each other in
  place — uninstall first.
• analyze, the unit tests, validate_guide.dart and the targetSdk 36 check
  on the merged manifest all stay.

The Play bundle is built on the release machine with tool/build_release.ps1,
which is now the only place the upload key is used, and which still verifies
the signature scheme, the certificate digest and targetSdk before writing to
dist/.

create_upload_key.ps1 no longer offers to base64 the keystore for a secret
that no longer exists.

After merging

Delete ANDROID_KEYSTORE_BASE64, ANDROID_KEYSTORE_PASSWORD,
ANDROID_KEY_ALIAS and ANDROID_KEY_PASSWORD from
Settings → Secrets and variables → Actions. Nothing reads them, and a secret
that exists is a secret that can leak.

Verification

Ran the workflow's build path locally with android/key.properties moved
aside, which is exactly the state a runner is in:

√ Built build/app/outputs/flutter-apk/app-release.apk (64.2MB)
Signer #1 certificate DN: C=US, O=Android, CN=Android Debug
android:targetSdkVersion="36"  android:versionCode="14"  android:versionName="2.0.0"

So the build succeeds without a keystore, the inverted certificate check
passes, and the manifest the targetSdk step reads is still produced by an
APK-only build. The workflow YAML parses.