Harden alpha release path

[R055LE]

What changed

• pins every GitHub Action to an immutable commit
• validates the Gradle wrapper and distribution checksum
• commits Gradle dependency verification metadata
• upgrades ConnectBot sshlib from 0.4.1 to 0.4.2
• adds the API 35 instrumented suite to the Android workflow
• requests and verifies 16 KiB APK alignment in the signing helper
• advances the next source candidate to 0.1.0-alpha.5
• corrects current-facing alpha, distribution, profile, and signing documentation

Why

The pre-invite audit found that local signing protected the permanent key but still trusted mutable CI inputs and a checksum produced by the same job as the APK. It also found a relevant sshlib maintenance release, missing instrumented CI coverage, a future-alignment guarantee gap, and stale adopter-facing documentation.

Alpha.4 remains the accepted signed artifact. Alpha.5 needs a signed update and physical-device regression before it replaces alpha.4 for invited testers.

Validation

• fresh test lint assembleDebug assembleRelease run with every task rerun
• API 35 instrumented suite: 66 passed, 3 documented opt-in cases skipped
• live OpenSSH adapter tests for password and imported-key authentication
• release JNI field-name contract
• disposable-key alpha.5 signing with v2/v3 verification and 16 KiB alignment
• actionlint
• staged and committed-history leak scans
• patch whitespace checks