Resolve apksigner from configured Android SDK

[dl-alexandre]

Summary

• keep PATH-first apksigner resolution
• fall back to the project's configured Android SDK and deterministically choose the highest executable semantic build-tools version
• fail closed and capture/discard combined verifier stdout + stderr

Verification

• mix test test/mob_dev/android_deploy_recovery_proof_test.exs test/mob_dev/android_deploy_recovery_test.exs (26 passed)
• real executable stderr nonreflection canary
• mix format --check-formatted
• mix credo --strict
• full suite: 2362/2373 passed; 11 known environment-only failures (missing mob_new templates and local mise Elixir beam EACCES), unchanged from baseline