Add Android APK release workflow

Bubblewrap TWA config for chat.sune, plus a manually dispatched workflow
that builds, signs, verifies against assetlinks.json, attests provenance
and publishes the release for the tag given as input.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

android/twa-manifest.json

@@ -0,0 +1,30 @@
+{
+  "packageId": "chat.sune",
+  "host": "sune.chat",
+  "name": "Sune",
+  "launcherName": "Sune",
+  "display": "standalone",
+  "orientation": "portrait",
+  "themeColor": "#FFFFFF",
+  "themeColorDark": "#FFFFFF",
+  "navigationColor": "#FFFFFF",
+  "navigationColorDark": "#FFFFFF",
+  "navigationDividerColor": "#00000000",
+  "navigationDividerColorDark": "#00000000",
+  "backgroundColor": "#000000",
+  "startUrl": "/",
+  "iconUrl": "https://sune.chat/appstore_content/%E2%9C%BA.png",
+  "maskableIconUrl": "https://sune.chat/appstore_content/%E2%9C%BA.png",
+  "webManifestUrl": "https://sune.chat/manifest.webmanifest",
+  "fullScopeUrl": "https://sune.chat/",
+  "additionalTrustedOrigins": ["https://sune.planetrenox.com"],
+  "enableNotifications": false,
+  "enableSiteSettingsShortcut": false,
+  "splashScreenFadeOutDuration": 300,
+  "fallbackType": "customtabs",
+  "minSdkVersion": 21,
+  "appVersion": "1.0.0",
+  "appVersionCode": 10000,
+  "signingKey": { "path": "./sune.jks", "alias": "sune" },
+  "generatorApp": "bubblewrap-cli"
+}