android-signing and trivy-fs-scan actions (android repo cleanup)

- android-signing: the keystore-restore step previously copy-pasted in
  habitude and ablage-android; no-op without the secret (unsigned build).
- trivy-fs-scan: lockfile-based dependency scan for artifact-building
  repos (APKs); non-blocking by default via enforce input.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg

android-signing/action.yaml

@@ -0,0 +1,45 @@
+name: Android Signing
+description: >
+  Restore an Android release-signing keystore from repo secrets so Gradle can
+  sign the release APK. Writes <key-alias>-release.jks plus keystore.properties
+  in the workspace. When the keystore secret is empty the step is a no-op and
+  the build stays unsigned — same optional-signing behavior the app repos had
+  with their copy-pasted versions of this step.
+
+inputs:
+  keystore-b64:
+    description: Base64-encoded release keystore (ANDROID_KEYSTORE_B64 secret).
+    required: false
+    default: ""
+  keystore-password:
+    description: Keystore/key password (ANDROID_KEYSTORE_PASSWORD secret).
+    required: false
+    default: ""
+  key-alias:
+    description: Key alias; also names the keystore file (<alias>-release.jks).
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - id: restore
+      shell: bash
+      env:
+        KEYSTORE_B64: ${{ inputs.keystore-b64 }}
+        KEYSTORE_PASSWORD: ${{ inputs.keystore-password }}
+        KEY_ALIAS: ${{ inputs.key-alias }}
+      run: |
+        set -euo pipefail
+        if [[ -z "${KEYSTORE_B64}" ]]; then
+          echo "No keystore secret configured; release build stays unsigned."
+          exit 0
+        fi
+        : "${KEYSTORE_PASSWORD:?keystore-b64 is set but keystore-password is empty}"
+        printf '%s' "${KEYSTORE_B64}" | base64 -d > "${KEY_ALIAS}-release.jks"
+        {
+          echo "storeFile=${PWD}/${KEY_ALIAS}-release.jks"
+          echo "storePassword=${KEYSTORE_PASSWORD}"
+          echo "keyAlias=${KEY_ALIAS}"
+          echo "keyPassword=${KEYSTORE_PASSWORD}"
+        } > keystore.properties
+        echo "Restored ${KEY_ALIAS}-release.jks and keystore.properties."