Pin and verify what goes into a release: JitPack confined to the
SPAKE2 module via exclusiveContent, the vendored subtree pulled by
commit SHA instead of a mutable tag, a pinned Docker base digest with
a checksummed cmdline-tools download, and a verifyScrcpyServer task
wired into every assets merge. The expected server checksum can be
overridden with -PscrcpyServerSha256 when the jar is built from
source.

build-apk now requires apksigner and fails unless independent
signature verification succeeds. Split the test image into unit and
e2e targets so JVM-only test runs do not download an emulator. Ship
THIRD_PARTY_NOTICES and the LGPL text for SPAKE2 in the APK. Add
scripts/check as the host quality gate.

The sed line range broke silently whenever the header grew or
shrank. Print from line 2 down to the first non-comment line
instead, so the usage text tracks the header.

Group names resolved on the host do not exist inside the container,
so the "kvm" fallback broke --group-add on hosts where getent found
no kvm group. stat the device instead; the numeric gid is all that
matters and /dev/kvm is already known to exist at this point.

The tag suffix had to be bumped by hand whenever the Dockerfile or
sdk-packages.txt changed; forgetting meant silently testing against
a stale image. Hash the two files into the tag so any edit
invalidates the cache automatically.

Native Java app for Android 12+ that mirrors another Android
device over wireless ADB, forwarding video, audio, touch input,
and clipboard. Bundles a pinned scrcpy-server.jar and the
vendored libadb-android stack. Supports h264/h265/av1 video and
raw/opus audio with in-app codec selection. No NDK, no Kotlin.
Includes JVM unit tests and a Docker-based emulator e2e rig.