ci: add pinned platform validation and maintainer-only signing workflows

Provide Android API 35/37 and Xcode jobs, dependency advisory checks, source invariants, and checksum-verified tools. Actions lint and available Linux static checks pass; hosted CI and all Apple-platform builds still require authorized runners. The manual release workflow never publishes and uses only owner-supplied signing credentials.

scripts/check-repository.py

@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+"""Static release invariants; these checks do not replace platform/runtime tests."""
+import json
+from pathlib import Path
+import plistlib
+import re
+import subprocess
+import xml.etree.ElementTree as ET
+
+ROOT = Path(__file__).resolve().parents[1]
+required = ["README.md", "LICENSE", "THIRD_PARTY_NOTICES.md", "CONTRIBUTING.md", "SECURITY.md",
+            "CHANGELOG.md", "docs/architecture.md", "docs/build-android.md", "docs/build-ios.md",
+            "docs/server-compatibility.md", "docs/release-process.md", "docs/validation.md"]
+for name in required:
+    assert (ROOT / name).is_file(), f"Missing {name}"
+
+paths = subprocess.check_output(["git", "ls-files", "--cached", "--others", "--exclude-standard"], cwd=ROOT, text=True).splitlines()
+for name in paths:
+    path = ROOT / name
+    if not path.is_file():
+        continue
+    assert not any(part in {"node_modules", "build", ".gradle", "DerivedData"} for part in path.relative_to(ROOT).parts), name
+    assert path.suffix not in {".jks", ".keystore", ".p12", ".mobileprovision", ".apk", ".aab"}, name
+    if path.suffix == ".xml":
+        ET.parse(path)
+    if path.suffix == ".xcprivacy":
+        with path.open("rb") as source:
+            assert plistlib.load(source)["NSPrivacyTracking"] is False
+    if path.suffix == ".json":
+        json.loads(path.read_text())
+    if path.suffix in {".swift", ".kt", ".kts", ".py", ".md", ".yml", ".xml", ".properties", ".mjs", ".sh"}:
+        text = path.read_text()
+        assert not re.search(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----", text), f"Private key in {name}"
+        if path.suffix == ".md":
+            for target in re.findall(r"\]\(([^)]+)\)", text):
+                if ":" not in target and not target.startswith("#"):
+                    assert (path.parent / target.split("#")[0]).exists(), f"Broken link in {name}: {target}"
+
+android = "{http://schemas.android.com/apk/res/android}"
+manifest = ET.parse(ROOT / "android/app/src/main/AndroidManifest.xml").getroot()
+app = manifest.find("application")
+assert app.get(android + "usesCleartextTraffic") == "false"
+assert app.get(android + "allowBackup") == "false"
+assert app.get(android + "debuggable") != "true"
+assert len(manifest.findall("application/activity/intent-filter")) == 1, "Unreviewed deep-link entry point"
+network = ET.parse(ROOT / "android/app/src/main/res/xml/network_security_config.xml").getroot()
+assert network.find("base-config").get("cleartextTrafficPermitted") == "false"
+assert [node.get("src") for node in network.findall(".//certificates")] == ["system"]
+assert "distributionSha256Sum=" in (ROOT / "android/gradle/wrapper/gradle-wrapper.properties").read_text()
+for workflow in (ROOT / ".github/workflows").glob("*.yml"):
+    for action in re.findall(r"uses:\s*([^\s#]+)", workflow.read_text()):
+        assert re.fullmatch(r"[\w.-]+/[\w./-]+@[0-9a-f]{40}", action), f"Unpinned action: {action}"
+assert "NSAllowsArbitraryLoads" not in (ROOT / "ios/project.yml").read_text()
+print(f"Repository invariants: {len(paths)} source/documentation paths checked.")