Restore release signing continuity for APK upgrades

[JSvandijk]

Android in-place updates require the new APK to be signed with the same certificate as the installed app. The current public GitHub release assets for v1.0.0 and v1.1.0 do not share the same signing certificate, so users who installed the earlier release cannot update in place and must uninstall first.\n\nVerified:\n- v1.0.0 signer SHA-256: 10e3439a555c81a49e1bdb03149336a8161ca9e842cef08b060f5546ef1c7dc1\n- v1.1.0 signer SHA-256: 90ec9c532ab8269b14195ec0d908ef30aad2985267814a002a6988c550c7474f\n\nImpact:\n- Android update flow breaks between public releases\n- uninstalling clears local app state\n- this weakens trust in GitHub release distribution\n\nFix direction:\n- confirm which keystore should be the stable public release identity\n- keep that keystore constant for all future tagged releases\n- document the migration path for any users already on mismatched historical builds\n- optionally add a release-time signer fingerprint check against the previous public release\n

[JSvandijk]

Build and release support for signing-lineage recovery is now in main. The repo can now produce a rotated release if both the previous and current release keystores are still available, using optional secrets for APK_OLD_KEYSTORE_*, APK_SIGNING_LINEAGE_BASE64, and APK_ROTATION_MIN_SDK_VERSION. This does not magically fix the already-published mismatch by itself: maintainers still need access to the old private key to cut the recovery release. I also verified the new batch flow locally with temporary old/new keystores and a successful rotated APK build.

[JSvandijk]

Maintenance check on May 5, 2026 after merging #19 and #20.

Current state:

• Release tooling still supports a stable release keystore and optional APK Signature Scheme v3 rotation/signing lineage through build-apk.bat and .github/workflows/release.yml.
• Local cmd /c build-apk.bat passed today with a dev-signed APK.
• The remaining blocker is operational, not code-only: a real recovery release requires access to the previous public release private key and the intended stable current release key.

Keeping this open until the release identity decision is proven with real signing material or documented as unrecoverable. Closing it now would overstate the state of already-published APK upgrade continuity.