Update rsync to 3.5.0 and Go to 1.26.6. Bound SSH handshakes, pin
host-key types, and build 16 KB-aligned hardened executables.

Checksum-pin every downloaded toolchain archive. Before publishing,
verify the APK was built from HEAD, the tag matches versionName,
apksigner passes, and the tree is clean; publish a sha256 sidecar
and treat published assets as immutable. Compare full unsigned APKs
in verify-repro and run the Android unit tests in CI.

ssh.Dial applies its Timeout only to the TCP connect, so a host that
accepts the connection and then stalls the SSH handshake hangs the
sync forever. Dial with a timeout, run the handshake under a deadline,
and clear the deadline once the connection is established.

The NDK names its prebuilt toolchain directory after the build host,
not the target. Hardcoding linux-x86_64 broke rsync/build.sh and
rsh/build.sh on macOS, which ships the toolchain under darwin-x86_64
(x86_64 binaries, run under Rosetta on Apple Silicon). Detect the
host with uname and fail loud on anything else.

Link: https://codeberg.org/0xlena/rsend/pulls/1

A garbage or out-of-range port silently fell back to 22 and connected
to the wrong place; fail loud instead.

rsh -keygen printed the pubkey but wrote the key pair into a directory,
so generating a key briefly left the plaintext private key on flash,
contradicting the documented invariant that it only ever exists in
memory. -keygen now emits the private key PEM on stdout and nothing
else; the app encrypts it immediately and derives the public key via
-pubkey, reusing the validated import path. Keygen failures now surface
as an error dialog instead of crashing the app from a bare thread.

A small Android app for one-way folder backup, a KISS alternative to
Syncthing. It bundles rsync (built from pinned source via the NDK) and
a pure-Go SSH transport, both shipped in the APK as lib*.so and run from
the native library directory.

rsend pins the host key, stores the ed25519 identity Keystore-encrypted,
pushes each folder additively or as a mirror, and runs on demand or on a
WiFi-only schedule. The build is self-contained and reproducible: make
setup provisions the toolchain, make builds rsync, rsh, and the APK.