fix(android): fail closed without exact native symbols

[bytemain]

Summary

• add an APK-aware native-symbol validator that requires the exact Hands classifier whenever libhandscrash.so is present
• verify archive manifest SHA-256, .debug_info, and APK/archive/manifest ELF build IDs for every ABI
• wire the gate through the reusable action and generic publisher, and transport exact symbols in GitHub Gradle, existing-APK, and GitLab examples
• document same-Maven-channel classifier resolution and add CI/fixture coverage

Why

The current copy-ready Android examples can publish an APK successfully without a native-symbols build asset. Native crashes are then permanently unsymbolicatable because APK/AAR libraries are stripped and exact unstripped bytes cannot be reconstructed later.

Validation

• bash -n scripts/publish-android.sh scripts/validate-android-native-symbols.sh examples/generic/*.sh tests/*.sh
• tests/test-validate-android-native-symbols.sh
  • valid exact archive passes
  • missing archive fails in auto
  • stripped archive fails
  • mismatched build ID fails
  • wrapper forwards --symbols
• actionlint passes for the CI and GitHub workflow examples
• all 9 YAML files parse
• real JitPack android-sdk-v0.11.2 AAR + native-symbols classifier: 3 ABI build-ID validation passes

Release note

After merge, move the floating v1 tag to this commit so existing @v1 consumers receive the integrity fix. This intentionally makes pipelines containing libhandscrash.so fail until they provide the matching classifier; native-symbols-policy: disabled remains an explicit emergency opt-out.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}