fix: verify signed release payloads and constrain provenance

The release verifier checks attested unsigned artifacts but can still report success when the installable APKs have a different signer or different payload. Its checksum check accepts incomplete inventories. The archive comparator also accepts invalid ZIPs, skips nested signature-like payloads, and treats literal ZIP filenames as unzip patterns.

This change addresses seven verification failure groups:

• invalid or ambiguous ZIPs accepted as equivalent;
• literal filenames misinterpreted as patterns or line records;
• nested META-INF payloads excluded as signing metadata;
• incomplete, duplicate, or unexpected checksum inventories accepted;
• installable APK signatures and the pinned release signer unchecked;
• signed APK/AAB payloads not tied to their attested unsigned counterparts;
• attestations accepted without restricting the release workflow, requested tag, or hosted runner.

Stream ZIP entries by exact name, validate the complete public asset inventory, run the pinned SDK's apksigner against every installable APK, compare signed payloads, and constrain gh attestation verification. Update the public verification guide and run the new tooling tests in CI. Signing remains local; this does not publish or sign a release.

Validation: 14 targeted tests pass; 12 fail against unchanged main. Archive tests exercise real ZIP files. End-to-end verifier tests use synthetic assets and stub gh/apksigner to exercise command policy and fail-closed behavior; they do not claim a live provenance or cryptographic-signature verification. A separate local integration built and signed a synthetic APK with Android Build Tools 37.0.0: the real signature verifier and payload comparison passed, and a changed payload was rejected. Actionlint, shell syntax checks, and git diff --check pass. The dedicated release-verification CI job also passes. Application tests are unaffected by this tooling-only change.

Risk: verification now needs Python 3.9+ and the pinned Android Build Tools even with --no-rebuild, and deliberately rejects incomplete/legacy release layouts. AAB payloads are compared, but their Play upload certificate is not claimed verified. These are newly reproduced defects, not claims to close old certificate-publication requests that current main already covers.

• Read repository guidance and reviewed the diff
• Added deterministic regression tests using synthetic data
• Reported validation and limitations