Production candidate 517f492bed04

What's Changed

• fix(mobile): recover Android release build memory limits (N/A) by @danicallero in #1108
• docs(mobile): explain why live-updates has no Gradle lockfile (#1116) by @danicallero in #1121
• style: apply low-risk Sonar cleanups (#1120) by @danicallero in #1123
• ci: freeze web lockfile, pin Docker/Tailscale actions, scope permissions (#1111, #1112) by @danicallero in #1122
• fix(web): handle brand mark and schedule owner failures (#1114, #1118) by @danicallero in #1124
• fix(api): assert admission order; portable event-day fixture path (#1113, #1115) by @danicallero in #1126
• fix: locale-aware filter sorting and dead sign-out branches (#1117, #1119) by @danicallero in #1125
• fix(applications): bound email/url validation regexes (#1110) by @danicallero in #1127
• chore: promote Sonar triage fixes and Android build fix (#1110-#1120) by @danicallero in #1128

Full Changelog: release-cdb95a745955...release-517f492bed04