[Release] Audit Android manifest permissions for release

[jjoonleo]

Backlog ID: ISSUE-010
Source: plans/release_app_todos.md

Goal

Ensure the release manifest contains only permissions needed for OnTime's user-facing functionality.

Parallelization

Status: codex-ready

Prerequisites

• None

Acceptance criteria

• Review main, debug, and profile Android manifests.
• Confirm release manifest permissions are limited to needed permissions.
• Document justification for POST_NOTIFICATIONS, SCHEDULE_EXACT_ALARM, USE_FULL_SCREEN_INTENT, RECEIVE_BOOT_COMPLETED, and VIBRATE.
• Remove any unused release permission if found.
• Confirm no plugin or manifest merge adds unexpected sensitive permissions.

Codex thread guidance

• Work only on this issue's scope.
• Do not modify unrelated release issues.
• If this issue is blocked by external access or human approval, prepare the needed checklist/text and leave the issue open.
• This issue is intended to be safe for an independent Codex thread now.