Wave 3 (#3): CI keystore integrity self-check (hash + keytool)

.gitea/workflows/release.yml

@@ -84,6 +84,11 @@ jobs:
           printf 'storeFile=../mindlist-release.keystore\nstorePassword=%s\nkeyAlias=%s\nkeyPassword=%s\n' \
             "$STORE_PASSWORD" "$KEY_ALIAS" "$KEY_PASSWORD" > android/keystore.properties
           echo "sdk.dir=$ANDROID_HOME" > android/local.properties
+          # Self-check: the decoded keystore must match the committed hash
+          # (safe to publish: file is password-encrypted) and open with the
+          # given alias/password. Fails fast with a clear message otherwise.
+          echo "632509e5f1bdda0633736e8bcdc0bc0ce405ebd02fd7187738029240b860b9b6  android/mindlist-release.keystore" | sha256sum -c -
+          keytool -list -keystore android/mindlist-release.keystore -storepass "$STORE_PASSWORD" -alias "$KEY_ALIAS" | head -2
 
       - name: Assemble signed release
         working-directory: android