Ship a signed release APK

The release build type reuses the debug signing config, so a downloaded APK
installs over an existing one instead of demanding an uninstall. This never
goes to Play, which rejects debug keys anyway, so there is no private key
worth safeguarding for years and no way to strand anyone on a version that
can no longer be updated.

That choice is load-bearing in one direction: a release build is not
DEBUGGABLE, so adb shell run-as stops reading app data back out, and there is
no in-app restore. A signature change would have cost the drill progress.

npm run release stages release/404-Layers-<version>.apk with a checksum and
verifies the signature, since an unsigned APK builds fine and only fails at
install time, on someone else's phone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -17,6 +17,25 @@ with what it does on that layer. Then it drills you on them.
 Left: sample mode, nothing held — three functions available. Right: the same
 screen with `SHIFT` held — thirty-five, and every pad now shows what it becomes.
 
+## Install
+
+Download the APK from the [latest release](https://git.jawhng.xyz/jawhng/404-Layers/releases),
+open it on your phone, and allow installing from unknown sources when Android
+asks. It needs **Android 7.0 or newer** and is about 3 MB.
+
+It isn't on the Play Store, so Android will warn you it came from outside the
+store — that warning is about where the file came from, not what's in it. Two
+things worth knowing before you trust a stranger's APK:
+
+- It's signed with a **debug key**, not a private one. Nothing here is worth
+  protecting with a key I'd have to keep safe for years, and it means a lost
+  keystore can never strand you on a version that can't be updated.
+- It asks for `INTERNET` and `VIBRATE`. The vibration is the drill feedback;
+  the internet permission is Capacitor's default and the app never uses it —
+  there are no network calls in the source, and everything it needs is bundled.
+
+Each release lists a `sha256` if you want to check the download.
+
 ## What it does
 
 | Tab | |
@@ -32,8 +51,9 @@ the combos you keep missing keep coming back. Progress is kept on the device.
 
 ## Status
 
-It works and it's in daily use on one phone. It is **not** on any app store: it's
-a debug-signed APK, sideloaded over `adb`.
+It works and it's in daily use on one phone. It is **not** on any app store:
+it's a sideloaded APK, either from the release page above or built from source
+below.
 
 It was built in two passes, and both are still in the repo:
 
@@ -70,6 +90,7 @@ npm run dev          # http://localhost:5173
 
 | Command | |
 |---|---|
+| `npm run release` | Build the signed release APK into `release/`, with its checksum |
 | `npm test` | The domain suite |
 | `npm run typecheck` | `tsc --noEmit` |
 | `npm run extract:data` | Regenerate the combo table from `reference/` |