ci: harden release and platform verification

[VincenzoImp]

Summary

• pin Flutter, Docker, Gradle, and GitHub Actions inputs
• validate release tag provenance/version before protected secrets are available
• require release signing, attest APKs, and fail on missing release assets
• build every advertised platform in CI
• prevent Docker build contexts and bind mounts from exposing local signing material
• align build/privacy documentation and semantic configuration checks

Verification

• dart format --output=none --set-exit-if-changed lib test
• flutter analyze
• flutter test (138 tests in the full stacked verification; PR1 passed its 77-test snapshot)
• flutter build web
• flutter build linux
• flutter build apk --debug --target-platform android-arm64
• unsigned release build refused with Release signing is required
• actionlint on all workflows
• docker compose config --quiet
• OSV: 0 known vulnerabilities across 112 locked Pub packages

Repository configuration required before release

Create/protect the GitHub release environment, move Android signing secrets into it, require approval, and restrict release-tag creation to trusted release automation.

Follow-up stack

Three focused follow-up layers are ready and fully verified in a native stack on the fork:

1. Recover unfinished document drafts
2. Bound and serialize image processing
3. Improve scanner accessibility and platform support

GitHub does not support native stacks across forks. To keep upstream diffs focused, each follow-up will be rebased onto the updated dev and opened here only after the preceding layer merges. The complete stack currently passes 138 tests and all six platform CI jobs.