build: verify release inputs

Pin and verify what goes into a release: JitPack confined to the
SPAKE2 module via exclusiveContent, the vendored subtree pulled by
commit SHA instead of a mutable tag, a pinned Docker base digest with
a checksummed cmdline-tools download, and a verifyScrcpyServer task
wired into every assets merge. The expected server checksum can be
overridden with -PscrcpyServerSha256 when the jar is built from
source.

build-apk now requires apksigner and fails unless independent
signature verification succeeds. Split the test image into unit and
e2e targets so JVM-only test runs do not download an emulator. Ship
THIRD_PARTY_NOTICES and the LGPL text for SPAKE2 in the APK. Add
scripts/check as the host quality gate.

1 files changed, 10 insertions, 0 deletions

diff --git a/scripts/check b/scripts/check
new file mode 100755
index 0000000..6886411
--- /dev/null
+++ b/scripts/check
@@ -0,0 +1,10 @@
+#!/bin/sh
+# Run the repository's host/VM quality gate.
+
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+"$ROOT/scripts/check-wrapper"
+"$ROOT/scripts/check-server"
+"$ROOT/gradlew" --no-daemon :app:test :adb:test :app:lint