docs: record verified native preview and unfinished PWA parity

Replace current wrapper claims with native architecture/security/build evidence, preserve historical documents, track all thirty pages and explicit release gates, correct brand attribution and provide the twelve-section delivery report without claiming completion. Native signing remains paused and Apple application/device validation outstanding.

docs/release-process.md

@@ -10,14 +10,14 @@ to either store. A debug APK or unsigned archive is not a production release.
    a provisional community identifier, not proof of registry/store ownership.
    Confirm use of the Yuvomi name, required attribution and independent status.
 3. Bump version/name/code in Android and the iOS project spec; update CHANGELOG.
-4. Run JVM/emulator/real-upstream HTTPS tests, portable Swift and Xcode simulator
+4. Run native JVM/Compose/emulator/real-upstream HTTPS tests, portable Swift and Xcode simulator
    tests, static checks, OSV scan, release builds and artifact inspection. Record
-   upstream revision, app SHA, OS/WebView/Xcode versions, results and checksums.
+   upstream revision, app SHA, OS/SDK/Xcode versions, results and checksums.
 5. Produce signed artifacts only using an authorized maintainer's credentials.
 6. Review store privacy/Data Safety answers for the app AND selected-server model,
    permission rationale, encryption/export compliance, screenshots, support URL,
-   vulnerability contact, and device demonstrations. A functional web companion
-   is not guaranteed to pass Apple's minimum-functionality review.
+   vulnerability contact, and device demonstrations. An incomplete native preview
+   is not a finished PWA replacement or App Store approval.
 7. Create a release/tag and publish artifacts/store submissions manually only
    after explicit maintainer authorization. Never force-push or rewrite history.
 
@@ -31,7 +31,10 @@ An authorized maintainer must separately sign the verified APK/AAB using their
 own keystore, alias and passwords with `zipalign`, `apksigner`, and `jarsigner`.
 Keep private material in a protected signing environment, never on the general
 validation runners. Securely back up the real upload key and use Play App Signing
-according to the owner's policy. No production key is generated here.
+according to the owner's policy. An initial owner-authorized key and repository
+secrets already exist outside Git; signing workflow changes are parked during
+the native rebuild. Preserve the key, do not generate a replacement or apply the
+old signing stash without review. See `native-parity.md`.
 Manually verify APK/AAB signatures and inspect
 the final manifest: no debuggable flag, HTTP/test CA or unintended exported component.
 Never distribute an `.integration` package or include its generated test resources.