Android: APK/AAB assembly + signing pipeline (gradle-free)

[hyperpolymath]

Context

gossamer now produces libgossamer.so for Android and generates the JVM shims + a manifest skeleton into generated/android/. What's missing for a shippable app is the packaging/signing pipeline that turns (generated Java + .so + app resources) into a signed APK/AAB.

Gradle's DSL is Groovy/Kotlin, which the estate language policy discourages; this issue is to provide a gradle-free path using the Android SDK command-line tools directly.

Asks

A just android-apk-style recipe (or a small Zig/Rust driver) that runs:

1. aapt2 compile + aapt2 link over the app resources + generated/android/AndroidManifest.template.xml;
2. javac (or d8 directly) → d8/r8 to dex the generated shims (generated/android/java/**);
3. assemble the APK with jniLibs/<abi>/libgossamer.so (from just android-build);
4. zipalign + apksigner (v2/v3) with a configurable keystore;
5. optional bundletool path for AAB.

Constraints / decisions to make

• minSdk 26, targetSdk 34.
• extractNativeLibs="true" is in the manifest skeleton today — revisit for AAB.
• Where the keystore/secrets live in CI (Play upload signing).
• Whether to wrap this in gossamer CLI or keep it a Justfile recipe.

Part of the Phase 5 "ready-to-depend-on" checklist (docs/architecture/android-components.adoc). Needed before neurophone#83 can ship to a device/Play.