ci: add pinned platform validation and maintainer-only signing workflows

Provide Android API 35/37 and Xcode jobs, dependency advisory checks, source invariants, and checksum-verified tools. Actions lint and available Linux static checks pass; hosted CI and all Apple-platform builds still require authorized runners. The manual release workflow never publishes and uses only owner-supplied signing credentials.

scripts/check-dependencies.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+"""Fail closed on OSV findings or unavailable advisory service. No app runtime use."""
+import json
+from pathlib import Path
+import re
+import urllib.request
+
+ROOT = Path(__file__).resolve().parents[1]
+coordinates = set()
+lockfile = ROOT / "android/app/gradle.lockfile"
+assert lockfile.is_file(), "Generate the reviewed Gradle dependency lockfile before scanning."
+for source in [ROOT / "android/app/build.gradle.kts", ROOT / "android/build.gradle.kts", lockfile,
+               ROOT / "android/buildscript-gradle.lockfile"]:
+    if source.exists():
+        coordinates.update(re.findall(r'([\w.-]+:[\w.-]+:[\w.+-]+)(?:["=])', source.read_text()))
+agp = re.search(r'id\("com.android.application"\) version "([^"]+)"', (ROOT / "android/build.gradle.kts").read_text())
+assert agp, "Cannot determine Android build plugin version"
+coordinates.add("com.android.tools.build:gradle:" + agp.group(1))
+queries = [{"package": {"ecosystem": "Maven", "name": coordinate.rsplit(":", 1)[0]},
+            "version": coordinate.rsplit(":", 1)[1]} for coordinate in sorted(coordinates)]
+request = urllib.request.Request("https://api.osv.dev/v1/querybatch", method="POST",
+                                 headers={"Content-Type": "application/json"},
+                                 data=json.dumps({"queries": queries}).encode())
+with urllib.request.urlopen(request, timeout=60) as response:
+    results = json.load(response)["results"]
+assert len(results) == len(queries)
+findings = [(coordinate, [item["id"] for item in result.get("vulns", [])])
+            for coordinate, result in zip(sorted(coordinates), results) if result.get("vulns")]
+if findings:
+    for coordinate, identifiers in findings:
+        print(coordinate, ", ".join(identifiers))
+    raise SystemExit("Dependency advisories require review and remediation before release.")
+print(f"OSV: no listed advisories for {len(coordinates)} locked/direct Maven coordinates and build plugins.")