ci: add pinned platform validation and maintainer-only signing workflows

Provide Android API 35/37 and Xcode jobs, dependency advisory checks, source invariants, and checksum-verified tools. Actions lint and available Linux static checks pass; hosted CI and all Apple-platform builds still require authorized runners. The manual release workflow never publishes and uses only owner-supplied signing credentials.

scripts/check-format.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+directory="${TMPDIR:-/tmp}/yuvomi-format-tools"
+mkdir -p "$directory"
+jar="$directory/ktlint-1.7.1.jar"
+if [ ! -f "$jar" ]; then
+  curl --fail --location https://repo.maven.apache.org/maven2/com/pinterest/ktlint/ktlint-cli/1.7.1/ktlint-cli-1.7.1-all.jar -o "$jar"
+fi
+printf '%s  %s\n' 5f3de4ee4014137b05c72ed68eb46fe686aeb11fbdef27faf77f55d51c1b2536 "$jar" | sha256sum -c -
+java -jar "$jar" 'android/**/*.kt' 'android/**/*.kts'