Release guide, download link, and retire the go-live checklist

[rghvgrv]

SubVora is live, so the docs should read like a shipped project rather than one about to be provisioned.

README — a download link, and a Status section that had drifted

Leads with ⬇ Get the Android APK plus the two things that confuse every sideload:

• Android blocks the first tap and offers a per-source "allow from this source" toggle, granted to whatever opened the file
• Play Protect warns about any APK not distributed through the Play Store — not a finding about this one

Neither is a fault, but both look like one to someone installing for the first time.

The Status paragraph was materially wrong:

Claimed	Reality
notifications_log, device_tokens tables	both dropped
"the nightly billing-date advance job"	deliberately removed — a date left in the past is the outstanding-charge signal, and that job erased it
—	predated change-password and optimistic concurrency entirely

Rewritten to what the code does, and to say the app is live.

DEPLOYMENT — "Distribution" becomes "Cutting a release"

Leads with the rule that cost four builds to learn:

Always tag from main, after pulling.

A tag-triggered run uses the workflow file from the tagged commit. Tag a feature branch and you bake in that branch's release-android.yml; no later merge reaches it, and gh run rerun re-runs the same stale file. The only exit is deleting the tag and re-cutting it — free while nothing has been downloaded, impossible afterwards. A tag on an unmerged commit is also an orphan, since squash-merging never puts that commit into main.

Added a failure table keyed to what Verify signing secrets prints:

Message	Cause
Alias <***> does not exist	ANDROID_KEY_ALIAS doesn't match the keystore
keystore password was incorrect	ANDROID_KEYSTORE_PASSWORD wrong
contains whitespace	secret piped into gh secret set kept the trailing newline
is empty	never set, or set on the repo instead of the production environment

Plus the PKCS12 rule — no separate key password exists, so ANDROID_KEY_PASSWORD must equal the store password — and where the binlog artifact lands when the publish itself fails.

Deploy verification now leads with /subscriptions/resolve

One call proves migration-before-boot three ways:

tier         : AutoFill        <- pg_trgm is live and scoring
providerName : Netflix         <- the catalog sync inserted providers
categoryId   : <non-null>      <- system categories seeded, resolved by name

And records why tier: Manual matters: the container booted before the migration, SubscriptionCatalogSyncService never retries, and /health stays green throughout. The failure is silent, which is exactly what makes it worth naming. The burn-rate check stays as the end-to-end confirmation.

GO_LIVE_CHECKLIST.md deleted

It was a tick-box duplicate of DEPLOYMENT's first-deploy section, for a first deploy that has now happened. Two descriptions of one procedure only drift — and it was already the one that omitted the Render deploy hook, which is precisely why autoDeploy: false sat there with nothing to deploy on this rollout.

Everything it had that DEPLOYMENT lacked was folded in first: the redeploy-if-booted-early box, the resolve check, and the SMTP-via-second-registration trick.

Remaining docs: TECHNICAL_REQUIREMENTS, NON_TECHNICAL_REQUIREMENTS, Design, ADDING_A_PROVIDER, DEPLOYMENT, debug/ANDROID_DEVICE — each with one job and no overlap. debug/ANDROID_DEVICE.md is now linked from the README table, which it wasn't before.

Verification

All internal markdown links resolve, no reference to the deleted file survives, and the release URL is live:

https://github.com/Splitzzyy/Subvora/releases/tag/v1.0.0

Docs only — no code, no workflow changes.