docs: complete signed release pipeline

[zefutoff]

Summary

• mark the Phase 5 signed release pipeline as complete

Validation

The signed-release pipeline has now been exercised successfully on main
using the protected GitHub release environment and the real release signing
material.

Successful workflow run:

37984476758

Validated commit:

73a8ee76e180cca7a03b6e13a38d820f7126ed26

The workflow successfully:

• restored the release keystore from protected environment secrets
• built the unsigned release APK
• verified the offline privacy invariant
• signed the APK with the release key
• verified APK Signature Scheme v2 and v3 signatures
• confirmed exactly one APK signer
• verified the signer certificate against the committed SHA-256 fingerprint
• verified the privacy invariant on the signed APK
• generated the signed APK checksum
• uploaded the signed APK and checksum as a GitHub Actions artifact
• removed the temporary keystore during cleanup

The resulting GitHub Actions artifact is:

grammalecte-android-signed-release

Previous failure and fix

The first production run exposed an apksigner output-format difference
between the local Android Build Tools version and the GitHub-hosted runner.

PR #28 made the certificate parser compatible with both formats while keeping
the single-signer and certificate-fingerprint protections intact.

The corrected workflow then completed successfully on main.

Roadmap

Completes:

Phase 5 — Signed release pipeline

The next Phase 5 item is:

SBOM / dependency inventory