Add reproducible release pipeline

[kasnder]

Summary

• build unsigned GitHub release APKs on pinned Ubuntu 22.04 infrastructure
• keep the long-lived Android signing keystore local to the release maintainer
• download, verify, align, sign, and publish the exact CI artifact with one local command
• document the release procedure and record build metadata/checksums

Why

The IzzyOnDroid rebuild showed that the Rust-built libwgbridge.so files differ when the official APK is built on macOS and the independent rebuild runs on Linux. A clean macOS rebuild reproduced the official native libraries byte-for-byte, isolating the failure to the host native toolchain.

This change standardizes release payload compilation on Linux while keeping the signing key out of hosted CI. The local publisher verifies that the workflow artifact commit matches the numeric tag, checks the unsigned APK checksum, signs only with the expected certificate, verifies v1/v2 signatures and 16 KB alignment, and creates a draft release for final testing.

Validation

• bash -n scripts/build_and_sign.sh
• workflow YAML parsed successfully
• git diff --check
• ./scripts/setup_rust_android.sh
• ./gradlew :app:assembleGithubRelease --offline --no-build-cache --no-configuration-cache --no-daemon
• confirmed exactly one unsigned, 16 KB-aligned release APK
• signed the APK with a throwaway keystore and verified v1/v2 enabled, v3/v4 disabled, and alignment preserved