v0.1.0: Android targetSdk 36/37 readiness scanner

First release: a static scanner and GitHub Action for the Android 16 (API 36) and Android 17 (API 37) targetSdk behaviour changes plus the Google Play target-API floor.

• 23 rules, each linked to the official Android documentation; text, Markdown, JSON, GitHub annotation and SARIF output.
• targetSdk is read without running Gradle (literals, version catalogs, gradle.properties, ext, Kotlin consts, AGP 9 targetSdk { version = release(..) }, single value in build-logic).
• Composite Action with step summary and SARIF file.

Verified

• 30 tests pass; CI green on Ubuntu, Windows and macOS (Python 3.9, 3.11, 3.13), wheel/sdist build and Action self-test on all three OSes.
• Run over 100 public Android repositories (353 findings in 69 of them). Hand-check of 40 random findings: 7 false positives before fixes, 1 after (docs/precision.md).

Not verified

• No Android runtime test: a finding means "the documented construct is present", not "the app breaks". Recall is not measured.
• The Action was self-tested with uses: ./; use from another repository via the v0.1.0 tag has not been exercised yet.
• Marketplace listing is a manual step for the repository owner (Developer Agreement checkbox in the release form); name uniqueness not checked.