doc: correct drift and move the build notes to the root

The Rsync comment about draining a hostile remote's pipe sat on the
Tally type, where it means nothing; it describes boundedLines. Scheduler
explained itself with what happened during development instead of the
constraint that WorkManager persists unique names across upgrades, and
MainActivity and SyncLog did the same. Keys pointed at a pin() that does
not exist. The App header restated the class name and omitted half of
what onCreate does. OUT_FORMAT had no caller outside its file.

The README layout list omitted fastlane. The e2e test hardcodes a copy
of the app's rsync vector with nothing saying so. useradd already writes
a locked password field, so "skip passwd -l" does not leave a non-locked
one and key auth is still refused; verified against sshd with UsePAM no.
The CI file also runs verify-repro on a tag, and the NDK and build-tools
are pinned by revision and verified against Google's manifest rather
than a checksum this repository owns, which the reproducibility notes
claimed for every input.

metadata/ held one document and nothing else, and reads as a store
metadata directory beside fastlane/metadata. Root, extensionless,
beside THIRD_PARTY.

1 files changed, 11 insertions, 6 deletions

diff --git a/README b/README
index f9722c9..d5fcf48 100644
--- a/README
+++ b/README
@@ -47,9 +47,10 @@ Layout
 - rsync/     build script that compiles pinned rsync from source via the NDK.
 - app/       Android app (Kotlin, classic Views); bundles both as lib*.so.
 - ci/        CI-agnostic build and test scripts; the Makefile drives them.
-- metadata/  reproducibility and F-Droid build notes.
+- fastlane/  F-Droid store listing: descriptions, changelogs, screenshots.
 - THIRD_PARTY  complete shipped-component inventory and license notices.
 - APACHE-2.0  license terms for the shipped Apache-licensed components.
+- REPRODUCIBLE-BUILDS  determinism, pinning, and F-Droid build notes.
 - versions   pinned toolchain and source versions; the single source of truth.
 
 
@@ -74,8 +75,9 @@ build; see versions.
 `make test` also requires host rsync and lets govulncheck query the public Go
 vulnerability database. No source code is uploaded. The APK lands under
 app/build/outputs/apk/. It is unsigned by default and cannot be installed until
-signed. .gitlab-ci.yml runs exactly those scripts and holds no build logic of
-its own: ci/setup-toolchain.sh, ci/test.sh, and ci/build.sh.
+signed. .gitlab-ci.yml runs exactly these scripts and holds no build logic of
+its own: ci/setup-toolchain.sh, ci/test.sh, ci/build.sh, and, on a tag,
+ci/verify-repro.sh.
 
 For a locally installable APK, create a keystore and a gitignored
 keystore.properties before building:
@@ -146,9 +148,12 @@ write-only root. As root on the server:
 
 This assumes UsePAM yes in sshd_config (the default on most distros; set it if
 your build has it off). With UsePAM yes a password-locked account still accepts
-key logins. With UsePAM no, sshd refuses any locked account even for keys
-("account is locked"); there, skip passwd -l, set PasswordAuthentication no, and
-leave the account with a non-locked password field.
+key logins. With UsePAM no, sshd refuses any account whose password field is
+locked, even for keys, and useradd writes a locked field of its own, so omitting
+passwd -l is not enough. There, set PasswordAuthentication no and give the
+account a password nobody knows:
+
+    printf 'rsendbackup:%s\n' "$(head -c 24 /dev/urandom | base64)" | chpasswd
 
 Put the app's public key in /srv/backup/.ssh/authorized_keys as one restricted
 line that forces rrsync, write-only, into that directory: