Fix alpha.5 release SSH regression

[R055LE]

What changed

• preserve cbssh's three Ed25519 JCA implementation classes in minified releases
• extend the release verifier to enforce their exact names in both the R8 mapping and assembled DEX
• advance the corrected candidate to 0.1.0-alpha.6 (10006)
• record alpha.5 as an immutable rejected artifact and document the alpha.6 acceptance boundary

Why

Alpha.5 installed successfully over alpha.4 but every SSH connection failed before authentication. sshlib 0.4.2 constructs its bundled Ed25519 provider during host-key verification. R8 moved that provider into the default package, causing the provider's runtime package lookup to return null.

Impact

The narrow keep rule restores Ed25519 host-key verification in the minified release. Alpha.6 still requires permanent signing and physical update acceptance before tester distribution.

Validation

• pre-fix alpha.5 release output is rejected by the new verifier
• isolated minified API 35 password SSH probe completed authentication, PTY creation, and shell startup
• ./gradlew --no-daemon test lint assembleDebug assembleRelease connectedDebugAndroidTest
• production JVM fixture adapter
• explicit Android password and encrypted imported-key fixture tests
• release shrinker-contract verifier
• workflow lint, shell syntax checks, diff checks, and staged secret scans