[Distribution] Publish Android builds to GitHub Releases on v* tags

[chtnnh]

Parent

Part of #79 (app distribution).

Summary

CI can already assemble a release APK on v* tags / workflow_dispatch (.github/workflows/android-preview.yml), with SHA-256 and provenance attestation — but the binary only lands as a GitHub Actions artifact (7-day retention). That is not a durable public download channel.

Why it matters

Non-technical users and organizers need a stable URL. Actions artifacts expire and are awkward to share under stress. README / website/ assume a real download path will exist.

Evidence

• Workflow uploads protestchat-android-preview-* artifacts; summary notes Expo template / non-production signing
• No GitHub Releases on the repo today
• Preview CI history: ci: publish Android preview artifacts #12, ci: stop the APK build running on every merge; cancel superseded runs #37

Proposed direction

On v* (and optionally manual): create/update a GitHub Release, attach APK + SHA256SUMS (and link attestation). Keep or retire the short-lived artifact upload once Releases work.

Done when

• Tagging vX.Y.Z produces a Release with APK + checksums
• Release notes point at how to verify the checksum
• Documented in README and/or website/README.md / get-started once the download page exists

Related

Production signing is separate (child of #79). Download page depends on this + #61.