Pin artifact hashes, ship R8 keep-rules and script the upgrade checks

[sbokatuk]

• Verify every resolved Maven artifact against the SHA-256 pins in build/maven-checksums.txt on every build, on both resolution paths - @(AndroidMavenLibrary) and the direct-download fallback - so a corrupted or tampered download fails the build instead of shipping. build/UpdateMavenChecksums.sh regenerates the pins on upgrade.
• Add build/verify-transitive-deps.py: checks each module's .module runtime dependencies against the declared coverage, and the ignore list against the .pom pollution it neutralises. CI runs it before packing, so a dependency upstream adds is a named failing coordinate rather than a NoClassDefFoundError in somebody's app.
• Ship consumer R8/ProGuard keep-rules in the WebView and Ndk packages, under buildTransitive/: their entry points are reached from .NET through JNI alone, so a shrunk Release build removed them. Asserted by new package-layout tests.
• README: fix the stale 3.12.1.1 install pins, and fail CI when README versions drift from Directory.Build.props (build/CheckReadmeVersions.sh)
• Pack docs/release-notes/.md into PackageReleaseNotes, with the releases page as fallback, so nuget.org stops showing empty notes
• Hoist the triplicated jctools/re2j versions into Directory.Build.props
• Document why the generated tier has no IntelliSense (the sources jars are Kotlin-only and the Javadoc importer parses Java) and the net8 sunset (dropped in the first release after 10 November 2026)