Ship a signed release APK

The release build type reuses the debug signing config, so a downloaded APK
installs over an existing one instead of demanding an uninstall. This never
goes to Play, which rejects debug keys anyway, so there is no private key
worth safeguarding for years and no way to strand anyone on a version that
can no longer be updated.

That choice is load-bearing in one direction: a release build is not
DEBUGGABLE, so adb shell run-as stops reading app data back out, and there is
no in-app restore. A signature change would have cost the drill progress.

npm run release stages release/404-Layers-<version>.apk with a checksum and
verifies the signature, since an unsigned APK builds fine and only fails at
install time, on someone else's phone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

package.json

@@ -8,8 +8,11 @@
     "sync:www": "bash scripts/sync-www.sh",
     "sync": "npm run build && npx cap sync android",
     "apk": "npm run sync && cd android && ./gradlew assembleDebug",
+    "apk:release": "npm run sync && cd android && ./gradlew assembleRelease",
     "apk:phase1": "npm run sync:www && npx cap sync android && cd android && ./gradlew assembleDebug",
     "install:apk": "adb install -r android/app/build/outputs/apk/debug/app-debug.apk",
+    "install:release": "adb install -r android/app/build/outputs/apk/release/app-release.apk",
+    "release": "node scripts/release.mjs",
     "device:awake": "bash scripts/device.sh awake",
     "device:keep-awake": "bash scripts/device.sh keep-awake",
     "device:sleep-normal": "bash scripts/device.sh sleep-normal",