[BarMal]

Summary

• require persistent release signing secrets for GitHub release APKs instead of silently producing debug-signed release artifacts
• derive versionName and monotonic versionCode from the vX.Y.Z release tag/workflow input
• verify the release APK signature with apksigner before publishing it

Why

The current release workflow can fall back to Gradle's debug key. On GitHub-hosted runners that key is generated per runner, so two release APKs can be signed with different certificates. Android then rejects an update over an existing Sploot install, which matches the observed Play Protect warning followed by the app not installing.

This does not remove Play Protect's generic "unknown developer" warning for sideloaded APKs; avoiding that properly requires Play distribution/reputation. It does fix the install/update path after choosing "install anyway", provided the repo has a stable release keystore configured.

Required repository secrets

The release workflow now fails fast unless these are configured:

• RELEASE_KEYSTORE_BASE64
• RELEASE_KEYSTORE_PASSWORD
• RELEASE_KEY_ALIAS
• RELEASE_KEY_PASSWORD

For the first fixed release, use a new version tag above the currently installed APK, for example v0.1.1 or later. If the currently installed APK was signed by a different key, Android will still require uninstalling the old package once before installing the new stable-signed stream.