fix: support apksigner certificate output variants

[zefutoff]

Summary

• fix release-certificate fingerprint extraction across apksigner output variants
• support both local Android Build Tools output and the newer GitHub-hosted runner format
• explicitly require exactly one APK signer before accepting the certificate
• preserve the existing release-certificate SHA-256 verification

Context

The first execution of the signed-release workflow on main successfully:

• restored the protected release keystore
• built the release APK
• verified the unsigned APK privacy invariant
• signed the APK with the expected release key
• produced valid APK Signature Scheme v2 and v3 signatures

The workflow then failed during certificate fingerprint parsing.

Local apksigner output used:

Signer #1 certificate SHA-256 digest: ...

The GitHub-hosted runner used:

V3.0 Signer: certificate SHA-256 digest: ...

The signature itself was valid and the certificate digest matched the expected
release certificate. Only the parser was too specific.

Fix

The parser now extracts the SHA-256 digest from any certificate digest line:

certificate SHA-256 digest:

instead of depending on the older Signer #1 prefix.

The script also verifies:

Number of signers: 1

before trusting the extracted certificate fingerprint.

This keeps the existing protection against signing a release with an
unexpected certificate.

Failed workflow evidence

First signed-release run:

Run ID: 37982810624

The runner successfully reported:

Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): true
Number of signers: 1

and:

V3.0 Signer: certificate SHA-256 digest:
0d8ac9f2341257482c8380be5758169f889e606691787d13edbbb9649a2f3144

The subsequent failure was:

Unable to read signer certificate SHA-256 from signed APK.

Validation

• shellcheck tools/sign-release-apk.sh
• git diff --check
• make check
• local signing with the real release keystore
• APK signature verification
• release certificate SHA-256 verification

Local validation still ends with:

Release signing certificate fingerprint verified.

Roadmap

No roadmap item is completed by this PR alone.

After merge, the Signed release workflow will be executed again from main.
The Phase 5 Signed release pipeline item will only be marked complete after
that real GitHub Actions run succeeds and its signed artifact is verified.