android-signing and trivy-fs-scan actions (android repo cleanup)

- android-signing: the keystore-restore step previously copy-pasted in
  habitude and ablage-android; no-op without the secret (unsigned build).
- trivy-fs-scan: lockfile-based dependency scan for artifact-building
  repos (APKs); non-blocking by default via enforce input.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg

trivy-fs-scan/action.yaml

@@ -0,0 +1,51 @@
+name: Trivy Filesystem Scan
+description: >
+  Scan the checked-out workspace for vulnerable dependencies (lockfile-based:
+  gradle.lockfile, package-lock.json, etc.) with Trivy. For repos that build
+  artifacts rather than container images. Requires the trivy binary on the
+  runner (noctrl/gitea-runner >= v9) — pin the job to linux,build,amd64.
+  Gradle projects must have dependency locking enabled with committed
+  lockfiles, or trivy has nothing to read.
+
+inputs:
+  path:
+    description: Directory to scan.
+    required: false
+    default: "."
+  severity:
+    description: Comma-separated Trivy severities to report.
+    required: false
+    default: HIGH,CRITICAL
+  enforce:
+    description: >
+      "true" fails the job on findings with an available fix; "false" only
+      reports them (start non-blocking, flip once the noise level is known).
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - id: scan
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        if ! command -v trivy >/dev/null 2>&1; then
+          echo "ERROR: trivy not found on this runner (needs noctrl/gitea-runner >= v9)" >&2
+          exit 1
+        fi
+
+        exit_code=0
+        if [[ "${{ inputs.enforce }}" == "true" ]]; then
+          exit_code=1
+        fi
+
+        echo "Scanning ${{ inputs.path }} (severities: ${{ inputs.severity }}, enforce: ${{ inputs.enforce }})"
+        trivy fs \
+          --scanners vuln \
+          --severity "${{ inputs.severity }}" \
+          --ignore-unfixed \
+          --exit-code "${exit_code}" \
+          --no-progress \
+          "${{ inputs.path }}"