chore(fdroid): single-source fastlane metadata + reproducible-build prep

Make fastlane/metadata/android/ the single source of truth for store
listing metadata, consumed directly by the official F-Droid repo and
transformed into the self-hosted repo's localized layout at release time.

- Move fdroid-metadata/<appid>/<locale>/ -> fastlane/metadata/android/<locale>/
  (git-tracked renames: summary->short_description, description->full_description,
  + title.txt, images/icon.png, images/phoneScreenshots/); keep the app-level
  .yml control file for the self-hosted `fdroid update`.
- Add scripts/fastlane_to_fdroid_localized.sh (fastlane -> F-Droid localized,
  incl. changelogs) and scripts/sync_changelog_to_fastlane.sh (CHANGELOG.md ->
  fastlane changelog); verified byte-identical to the previous metadata.
- release.yaml: build self-hosted metadata from the fastlane tree and sync the
  per-version changelog before the transform (one changelog source for both
  channels).
- Disable AGP VCS-info embedding on release builds (vcsInfo { include = false })
  so builds reproduce byte-for-byte vs the distributed APK — the only file that
  otherwise differed (META-INF/version-control-info.textproto). Effective from
  the next release.
- Add docs/fdroid-official/ (draft fdroiddata recipe: reproducible build +
  AllowedAPKSigningKeys + Binaries + notes).
- Repoint README screenshots/icon, update docs/README + RELEASING, and skip the
  Android build on fastlane-only changes (ci.yaml).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/fdroid-official/README.md

@@ -0,0 +1,94 @@
+# Official F-Droid submission (draft)
+
+Goal: publish Calendula to the **official F-Droid repo** *alongside* the
+self-hosted repo, as **one app** — same signed binary in both channels, so
+existing self-hosted users migrate with no reinstall and no data loss.
+
+This folder holds the **draft** fdroiddata recipe. Nothing here is submitted
+yet. The self-hosted pipeline (`../../fdroid-metadata/`, `.gitea/workflows/release.yaml`)
+is unaffected by these files.
+
+## Publishing model: reproducible build + developer-signed binary
+
+F-Droid builds Calendula from source on its buildserver, then verifies the
+output is byte-for-byte identical to **our** signed APK (fetched via the
+`Binaries` URL). On a match it publishes **our** binary, signed with **our**
+key — identified by `AllowedAPKSigningKeys`. Result: official and self-hosted
+both carry the same signature. If a build ever fails to match, F-Droid simply
+skips that version (fails safe — no bad publish).
+
+## Verification status (2026-06-21)
+
+- ✅ **Run-to-run reproducible** — `v2.7.0` built twice from a clean worktree
+  (R8 minify + resource-shrink, build cache off) → byte-for-byte identical
+  (`sha256 568c944a…`).
+- ✅ **Cross-JDK reproducible** — rebuilt with JDK 17 and JDK 21 → identical
+  APK. JDK version is not a sensitivity, so it need not be pinned.
+- ✅ **Tag self-consistent** — committed `versionCode`/`versionName` already
+  equal the tag-derived values, so F-Droid building the tag as-is matches the
+  CI-published binary (CI's `sed` substitution is a no-op).
+- ✅ **App signing cert SHA-256 extracted** from published APKs (identical
+  across v1.0.0 / v2.0.0 / v2.4.0): `5cdaee8e…`. No keystore needed.
+- ✅ **Eligibility** — MIT, 100% FOSS deps (no Play Services / Firebase /
+  analytics / billing), no `INTERNET` permission, no native code.
+- ✅ **End-to-end reproducible vs the DISTRIBUTED binary** — built tag `v2.7.1`
+  from source and compared against the published `calendula_v2.7.1.apk`: every
+  app entry (dex / resources / assets / manifest) byte-identical. The only
+  difference was `META-INF/version-control-info.textproto` (AGP's git metadata,
+  env-dependent). Fixed with `vcsInfo { include = false }` on the release build;
+  re-validated → 0 non-signature differences. **Takes effect from the first
+  release built after that change — submit the recipe starting at that version**
+  (v2.7.1 and earlier still embed the textproto and won't verify).
+- ⚠️ **Not yet proven**: cross-host / fixed-build-path reproducibility on
+  F-Droid's buildserver (low risk for a no-NDK pure-JVM app; with vcsInfo
+  disabled, the env-dependent field is gone; F-Droid confirms at review).
+- ✅ **Buildserver toolchain supported** (checked 2026-06-21):
+  - **Gradle 9.5.1** is in F-Droid's gradle-transparency-log (`checksums.json`)
+    with a verified sha256, so `gradlew.py` will download + verify + run it.
+  - **AGP 9.2** is in `gradlew.py`'s `MIN_GRADLE_VERSION` map (`9.2 -> 9.4.1`).
+  - **JDK 17** is standard on the buildserver (AGP 9.2 requires exactly 17).
+  - **build-tools 36.0.0 / android-37**: not statically preinstalled (baseline
+    stops at 33), but `provision-android-sdk` makes `$ANDROID_HOME/build-tools`
+    and `/platforms` group-writable so AGP/Gradle install newer ones on demand.
+
+## Before submitting — checklist
+
+1. Confirm the `Binaries` URL is publicly reachable and stable long-term, e.g.
+   `https://apps.dev.jeanlucmakiola.de/dev/fdroid/repo/calendula_v2.7.0.apk`
+   resolves to the dev-signed APK. F-Droid re-fetches it on every build.
+2. Confirm F-Droid's buildserver supports the toolchain (see timing risk).
+3. (Recommended) Reproduce one published release end-to-end: build the tag from
+   source, strip signatures, and diff against the downloaded `calendula_v<ver>.apk`
+   to confirm the from-source build matches the *distributed* binary — not just
+   another local build.
+
+## Submission steps (fdroiddata, GitLab)
+
+1. Fork `https://gitlab.com/fdroid/fdroiddata`.
+2. Copy `de.jeanlucmakiola.calendula.yml` to `metadata/` in the fork.
+3. Test locally with `fdroid build -v de.jeanlucmakiola.calendula` and
+   `fdroid lint de.jeanlucmakiola.calendula` (and `fdroid readmeta`).
+4. Open a Merge Request. Initial review can take weeks to months; the
+   self-hosted repo keeps serving in the meantime, so there's no rush.
+
+## Listing metadata (descriptions, screenshots, icon)
+
+These are **not** in the recipe `.yml`. F-Droid's `fdroid update` harvests them
+automatically from the fastlane tree in the app's source repo:
+
+    fastlane/metadata/android/<locale>/
+      short_description.txt   full_description.txt   title.txt
+      images/icon.png         images/phoneScreenshots/*.png
+      changelogs/<versionCode>.txt   (optional, per release)
+
+This is the single source of truth: en-US + de-DE already exist there, and the
+self-hosted repo is generated from the same tree at release time via
+`scripts/fastlane_to_fdroid_localized.sh`. Nothing extra to add to fdroiddata —
+F-Droid picks the listing up from source. (Screenshots may not be committed to
+the fdroiddata repo anyway, so the source-tree fastlane layout is required.)
+
+Per-version changelogs: the self-hosted release workflow generates
+`changelogs/<versionCode>.txt` at release time. For the official repo to show a
+changelog, that file must be committed into `fastlane/metadata/android/<locale>/changelogs/`
+at the tagged commit — wire this into the release/version-bump step, or accept
+no in-client changelog for the official listing initially.