chore(fdroid): finalize recipe at v2.7.3 + reproducible-release CI guard

v2.7.3 is the first release built with `vcsInfo { include = false }` and is
verified reproducible: a clean from-source build matched the published
calendula_v2.7.3.apk byte-for-byte across all 1382 zip entries (only the
signature block differs, which F-Droid copies).

- Point the fdroiddata recipe's Builds entry + CurrentVersion at v2.7.3
  (was the 2.7.2 placeholder, which lacks the fix and would fail verification).
- UpdateCheckMode: Tags ^v[0-9.]+$ — after this one-time submission F-Droid
  auto-tracks new release tags and adds build entries itself; no manual recipe
  edits per release.
- Add scripts/check_reproducible_release.sh + an always-on CI step asserting the
  release build keeps VCS-info disabled, so reproducibility can't silently
  regress and quietly stop official-repo publishing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/check_reproducible_release.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Reproducibility guard for the official F-Droid repo.
+#
+# F-Droid only republishes OUR signed binary if a from-source build reproduces
+# it byte-for-byte. AGP's VCS-info injection writes
+# META-INF/version-control-info.textproto with build-environment git metadata
+# (commit hash / path) — env-dependent, and the one thing that broke
+# reproducibility before we disabled it. It MUST stay off on the release build,
+# or new versions silently stop publishing to the official repo (fails safe, but
+# you'd be stuck on an old version without noticing). Fail loudly if it regresses.
+set -euo pipefail
+F="app/build.gradle.kts"
+
+# Match `vcsInfo { ... include = false ... }` within the block, tolerant of
+# whitespace/newlines (-z: whole file as one record; [^}] stays inside the block).
+if grep -Pzoq 'vcsInfo\s*\{[^}]*include\s*=\s*false' "$F"; then
+  echo "OK: release build disables AGP VCS-info — stays reproducible for F-Droid."
+else
+  echo "ERROR: '$F' release build is missing 'vcsInfo { include = false }'." >&2
+  echo "AGP would embed env-dependent git metadata (version-control-info.textproto)," >&2
+  echo "breaking F-Droid reproducible builds. Restore it. See docs/fdroid-official/." >&2
+  exit 1
+fi