build: verify release inputs

Pin and verify what goes into a release: JitPack confined to the
SPAKE2 module via exclusiveContent, the vendored subtree pulled by
commit SHA instead of a mutable tag, a pinned Docker base digest with
a checksummed cmdline-tools download, and a verifyScrcpyServer task
wired into every assets merge. The expected server checksum can be
overridden with -PscrcpyServerSha256 when the jar is built from
source.

build-apk now requires apksigner and fails unless independent
signature verification succeeds. Split the test image into unit and
e2e targets so JVM-only test runs do not download an emulator. Ship
THIRD_PARTY_NOTICES and the LGPL text for SPAKE2 in the APK. Add
scripts/check as the host quality gate.

1 files changed, 39 insertions, 0 deletions

diff --git a/scripts/check-server b/scripts/check-server
new file mode 100755
index 0000000..9a895a1
--- /dev/null
+++ b/scripts/check-server
@@ -0,0 +1,39 @@
+#!/bin/sh
+# Verify the scrcpy server asset against its tracked SHA-256 sidecar.
+
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+ASSETS="$ROOT/app/src/main/assets"
+JAR="$ASSETS/scrcpy-server.jar"
+SUM="$ASSETS/scrcpy-server.sha256"
+VERSION="$ASSETS/scrcpy-server.version"
+
+for file in "$JAR" "$SUM" "$VERSION"; do
+    if [ ! -s "$file" ]; then
+        echo "check-server: $file is missing or empty" >&2
+        exit 1
+    fi
+done
+
+expected=$(awk 'NR == 1 { print $1 }' "$SUM")
+case "$expected" in
+    *[!0-9a-f]*|'')
+        echo "check-server: invalid SHA-256 in $SUM" >&2
+        exit 1
+        ;;
+esac
+if [ "${#expected}" -ne 64 ]; then
+    echo "check-server: invalid SHA-256 length in $SUM" >&2
+    exit 1
+fi
+
+actual=$(sha256sum "$JAR" | awk '{ print $1 }')
+if [ "$actual" != "$expected" ]; then
+    echo "check-server: scrcpy-server.jar checksum mismatch" >&2
+    echo "  want: $expected" >&2
+    echo "  got:  $actual" >&2
+    exit 1
+fi
+
+echo "check-server: ok ($(cat "$VERSION"))"