chore: clean up generated mobile artifacts

[pwltr]

Summary

• add split iOS, Android, and lightweight bindgen validation workflows
• stop tracking generated Android Kotlin bindings and iOS XCFramework release payloads
• generate iOS XCFramework artifacts under dist/ios with deterministic zip metadata
• document and ignore generated mobile binary outputs

See #114

Validation

• ruby -e "require 'yaml'; Dir['.github/workflows/*.{yml,yaml}'].sort.each { |f| YAML.load_file(f); puts "ok #{f}" }"
• bash -n build.sh build_ios.sh build_android.sh build_python.sh
• git diff --check
• cargo metadata --locked --format-version 1
• swift package dump-package
• ./gradlew projects --no-daemon

[pwltr]

Same as pubky/paykit-rs#153 and synonymdev/vss-rust-client-ffi#11

[ovi-reviewer]

Verdict: ✅ Approve

---

Review: diff 13 files.

Findings:
1 inline (non-blocking)
Security audit skipped - no security surface in the diff (score 0, threshold 3)

---

Reviewed by opus-xhigh via gh-pr-review-loop skill

[ovi-reviewer]

The filter covers **/build*.sh and **/Package.swift, but not update_package.py, the script build_ios.sh line 113 invokes to write the checksum and tag values that Package.swift turns into the binary target URL. A change there that breaks the substitution would merge without this workflow running, surfacing only when a release is cut. Could we add update_package.py to both the pull_request and push path lists?

[ovitrif]

Approved