android-signing and trivy-fs-scan actions (android repo cleanup)

- android-signing: the keystore-restore step previously copy-pasted in
  habitude and ablage-android; no-op without the secret (unsigned build).
- trivy-fs-scan: lockfile-based dependency scan for artifact-building
  repos (APKs); non-blocking by default via enforce input.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg

README.md

@@ -105,6 +105,34 @@ exist. Requires `skopeo` on the runner (`noctrl/gitea-runner` >= v10).
     registry-password: ${{ secrets.REGISTRY_PASSWORD }}
 ```
 
+### Android Signing
+
+Restores the Android release keystore (`<alias>-release.jks` + `keystore.properties`)
+from repo secrets; no-op when the secret is unset (build stays unsigned).
+
+**Location:** [`./android-signing`](./android-signing)
+
+```yaml
+- uses: https://gitea.noctrl.eu/public/actions/android-signing@v12
+  with:
+    keystore-b64: ${{ secrets.ANDROID_KEYSTORE_B64 }}
+    keystore-password: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+    key-alias: habitude
+```
+
+### Trivy Filesystem Scan
+
+Scans the checked-out workspace for vulnerable dependencies (lockfile-based) —
+for repos that build artifacts (APKs) rather than images. Non-blocking by
+default (`enforce: "false"`); requires committed Gradle lockfiles and the
+trivy binary on the runner. Pin the job to `linux,build,amd64`.
+
+**Location:** [`./trivy-fs-scan`](./trivy-fs-scan)
+
+```yaml
+- uses: https://gitea.noctrl.eu/public/actions/trivy-fs-scan@v12
+```
+
 ### Deploy Prod
 
 Shared deploy body for the `*.podman` infrastructure repos: installs the SSH