chore(fdroid): finalize recipe at v2.7.3 + reproducible-release CI guard

v2.7.3 is the first release built with `vcsInfo { include = false }` and is
verified reproducible: a clean from-source build matched the published
calendula_v2.7.3.apk byte-for-byte across all 1382 zip entries (only the
signature block differs, which F-Droid copies).

- Point the fdroiddata recipe's Builds entry + CurrentVersion at v2.7.3
  (was the 2.7.2 placeholder, which lacks the fix and would fail verification).
- UpdateCheckMode: Tags ^v[0-9.]+$ — after this one-time submission F-Droid
  auto-tracks new release tags and adds build entries itself; no manual recipe
  edits per release.
- Add scripts/check_reproducible_release.sh + an always-on CI step asserting the
  release build keeps VCS-info disabled, so reproducibility can't silently
  regress and quietly stop official-repo publishing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -30,6 +30,12 @@ jobs:
           # Full history so the base..HEAD diff below has a merge-base.
           fetch-depth: 0
 
+      # Cheap, always-on guard: the release build must stay reproducible for the
+      # official F-Droid repo (no AGP VCS-info embedding). Runs regardless of
+      # change scope so a regression can't slip through on a "docs-only" PR.
+      - name: Reproducible-release invariant
+        run: bash scripts/check_reproducible_release.sh
+
       # Decide whether anything that affects the app build changed. Docs,
       # F-Droid metadata and the licence don't, so those PRs skip the SDK +
       # Gradle work below but still report a green `ci`.