[Distribution] Production Android signing (replace Expo template key)

[chtnnh]

Parent

Part of #79 (app distribution).

Summary

The Android preview workflow builds assembleRelease but the job summary states signing is the Expo template debug / non-production key. That is fine for internal smoke tests; it is not acceptable as a public “release” users should trust long-term.

Why it matters

• Users cannot meaningfully pin trust to a known signing key
• Updates / sideload upgrades break or look suspicious across key changes
• Checksums alone do not replace a stable publisher identity

Evidence

• .github/workflows/android-preview.yml — “Signing: Expo template debug key (non-production)”
• Threat model / site trust copy assume users pick a source they trust; that source needs a real key

Proposed direction

• Decide key custody (maintainer-held keystore, hardware token, or Play App Signing if Play is ever in scope — see distribution policy child)
• Wire CI (or a documented manual step) to sign with that key
• Publish the signing certificate fingerprint next to Releases / download page

Done when

• Public Android builds are signed with a production key under documented custody
• Fingerprint published for users who want to verify
• Preview/debug signing is clearly labeled as non-release if it remains

Related

Pairs with GitHub Releases child of #79. Store policy may affect Play App Signing.