build: verify release inputs

Pin and verify what goes into a release: JitPack confined to the
SPAKE2 module via exclusiveContent, the vendored subtree pulled by
commit SHA instead of a mutable tag, a pinned Docker base digest with
a checksummed cmdline-tools download, and a verifyScrcpyServer task
wired into every assets merge. The expected server checksum can be
overridden with -PscrcpyServerSha256 when the jar is built from
source.

build-apk now requires apksigner and fails unless independent
signature verification succeeds. Split the test image into unit and
e2e targets so JVM-only test runs do not download an emulator. Ship
THIRD_PARTY_NOTICES and the LGPL text for SPAKE2 in the APK. Add
scripts/check as the host quality gate.

1 files changed, 11 insertions, 3 deletions

diff --git a/test b/test
index 242cee3..ec31236 100755
--- a/test
+++ b/test
@@ -16,11 +16,19 @@
 set -eu
 
 ROOT="$(cd "$(dirname "$0")" && pwd)"
+cmd="${1:-unit}"
+
+target=unit
+case "$cmd" in
+    e2e|all|record) target=e2e ;;
+esac
+
 # The image tag is a hash of the rig inputs, so editing the Dockerfile
 # or the SDK package list automatically invalidates the cached image.
-IMG="scrcpy-android-test:$(cat "$ROOT/test-rig/Dockerfile" "$ROOT/test-rig/sdk-packages.txt" | sha256sum | cut -c1-12)"
+IMG="scrcpy-android-test-$target:$(cat "$ROOT/test-rig/Dockerfile" \
+    "$ROOT/test-rig/sdk-packages.txt" "$ROOT/test-rig/sdk-packages-e2e.txt" \
+    | sha256sum | cut -c1-12)"
 
-cmd="${1:-unit}"
 case "$cmd" in
     unit|e2e|all|record|apk) ;;
     -h|--help)
@@ -48,7 +56,7 @@ if ! docker image inspect "$IMG" >/dev/null 2>&1; then
         echo "             Build will likely fail. Fix the host DNS (e.g." >&2
         echo "             append 'nameserver 1.1.1.1' to /etc/resolv.conf) and retry." >&2
     fi
-    docker build --network=host -t "$IMG" "$ROOT/test-rig"
+    docker build --network=host --target "$target" -t "$IMG" "$ROOT/test-rig"
 fi
 
 # KVM check for tiers that boot the emulator.