Ship a signed release APK

The release build type reuses the debug signing config, so a downloaded APK
installs over an existing one instead of demanding an uninstall. This never
goes to Play, which rejects debug keys anyway, so there is no private key
worth safeguarding for years and no way to strand anyone on a version that
can no longer be updated.

That choice is load-bearing in one direction: a release build is not
DEBUGGABLE, so adb shell run-as stops reading app data back out, and there is
no in-app restore. A signature change would have cost the drill progress.

npm run release stages release/404-Layers-<version>.apk with a checksum and
verifies the signature, since an unsigned APK builds fine and only fails at
install time, on someone else's phone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -20,6 +20,9 @@ android/local.properties
 android/.idea/
 *.apk
 *.aab
+# Staged release artifacts. The APK is covered above; this also catches the
+# checksum file that sits beside it.
+release/
 # No exception for debug.keystore: an earlier "!debug.keystore" here deliberately
 # un-ignored it, which would have committed a signing key silently had one ever
 # landed in the tree. Signing keys belong in ~/.android, not in the repo.