Release signing and publishing pipeline in CI (GitHub Environments, SOPS boundary) #49

Part of #14 (W0 → release infrastructure). Blocked by #46 (#16 closed). Feeds #31 and #35.

Open question: the nightly flavor has its own application id (.nightly suffix: io.put.putio.nightly on TV, io.put.putio.mobile.nightly on mobile; PutioAndroidApplicationPlugin.kt) while AGENTS.md says Play internal/closed tracks ship nightly, so those tracks would be a separate Play package from io.put.putio. Needs a ruling before the release lane.

Outcome

Release signing and publishing work in GitHub Actions within the workspace CI boundary: GitHub Environment secrets or OIDC, SOPS-routed payloads, no 1Password at runtime. Apply the workspace release supply-chain checklist.

Scope

• Signing config wired for release builds of both flavors (keystore injected from CI secrets, never committed; signingConfigs currently absent entirely)
• Play publishing step (internal/beta tracks) using the service account from Release credentials custody: Play Console access, signing lineage, Sentry DSN (owner: Altay) #46
• Fire TV S3 sideload artifact step (replaces the legacy fastlane upload_to_s3 lane)
• versionCode strategy implemented (>91 family, form-factor scheme from the one-package decision)
• Release checklist doc in the repo per the workspace release-security routing

Acceptance criteria

• A tagged run produces signed, Play-uploadable artifacts for both flavors from CI alone
• DoD: CI run linked as proof; a signed artifact installed on the harness with a screenshot