ci: add pinned platform validation and maintainer-only signing workflows

Provide Android API 35/37 and Xcode jobs, dependency advisory checks, source invariants, and checksum-verified tools. Actions lint and available Linux static checks pass; hosted CI and all Apple-platform builds still require authorized runners. The manual release workflow never publishes and uses only owner-supplied signing credentials.

scripts/select-simulator.py

@@ -0,0 +1,21 @@
+#!/usr/bin/env python3
+"""Select an available iPhone instead of depending on a runner-specific device name."""
+import json
+import re
+import subprocess
+
+devices = json.loads(subprocess.check_output(["xcrun", "simctl", "list", "devices", "available", "--json"]))
+phones = []
+for runtime, entries in devices["devices"].items():
+    match = re.search(r"\.iOS-(\d+)-(\d+)", runtime)
+    if not match:
+        continue
+    version = tuple(map(int, match.groups()))
+    if version < (18, 4):
+        continue
+    phones.extend((version, device) for device in entries
+                  if device.get("isAvailable") and device["name"].startswith("iPhone"))
+phones.sort(key=lambda entry: entry[0], reverse=True)
+if not phones:
+    raise SystemExit("No available iPhone simulator; install an iOS simulator runtime in Xcode.")
+print(phones[0][1]["udid"])