Script local alpha signing - #6

What changed

• add a guarded wrapper that selects the successful Android build for the exact current main commit
• download the unsigned candidate into a private temporary directory and hand it to the existing signing verifier
• preserve interactive password entry and document the resumable local workflow
• test the wrapper in CI with an isolated fake repository and GitHub CLI

Why

Local signing had too many manual steps to reconstruct safely after time away from the project. This keeps the signing passwords as a human-entered boundary while automating candidate selection, provenance checks, download, and cleanup.

This does not publish signed APKs or change the current distribution policy.

Validation

• bash -n scripts/sign-latest-alpha.sh scripts/test-sign-latest-alpha.sh
• ./scripts/test-sign-latest-alpha.sh
• actionlint .github/workflows/android.yml
• ./gradlew --no-daemon test lint assembleDebug assembleRelease
• git diff --check
• staged gitleaks scan