chore(fdroid): single-source fastlane metadata + reproducible-build prep

Make fastlane/metadata/android/ the single source of truth for store
listing metadata, consumed directly by the official F-Droid repo and
transformed into the self-hosted repo's localized layout at release time.

- Move fdroid-metadata/<appid>/<locale>/ -> fastlane/metadata/android/<locale>/
  (git-tracked renames: summary->short_description, description->full_description,
  + title.txt, images/icon.png, images/phoneScreenshots/); keep the app-level
  .yml control file for the self-hosted `fdroid update`.
- Add scripts/fastlane_to_fdroid_localized.sh (fastlane -> F-Droid localized,
  incl. changelogs) and scripts/sync_changelog_to_fastlane.sh (CHANGELOG.md ->
  fastlane changelog); verified byte-identical to the previous metadata.
- release.yaml: build self-hosted metadata from the fastlane tree and sync the
  per-version changelog before the transform (one changelog source for both
  channels).
- Disable AGP VCS-info embedding on release builds (vcsInfo { include = false })
  so builds reproduce byte-for-byte vs the distributed APK — the only file that
  otherwise differed (META-INF/version-control-info.textproto). Effective from
  the next release.
- Add docs/fdroid-official/ (draft fdroiddata recipe: reproducible build +
  AllowedAPKSigningKeys + Binaries + notes).
- Repoint README screenshots/icon, update docs/README + RELEASING, and skip the
  Android build on fastlane-only changes (ci.yaml).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/fdroid-official/de.jeanlucmakiola.calendula.yml

@@ -0,0 +1,58 @@
+# ---------------------------------------------------------------------------
+# DRAFT fdroiddata metadata for the OFFICIAL F-Droid repository.
+#
+# This is NOT the self-hosted metadata (that lives in ../../fdroid-metadata/).
+# When submitting, this file's contents go to fdroiddata on GitLab as
+#   metadata/de.jeanlucmakiola.calendula.yml
+# See README.md in this folder for the verification status and submission steps.
+#
+# Publishing model: REPRODUCIBLE BUILD + developer-signed binary.
+# F-Droid builds from source on its buildserver, then verifies the result is
+# identical to our own signed APK (fetched via `Binaries`). If it matches,
+# F-Droid publishes OUR binary signed with OUR key (`AllowedAPKSigningKeys`),
+# so the official and self-hosted channels carry the SAME signature and users
+# migrate between them with no reinstall / no data loss.
+# ---------------------------------------------------------------------------
+
+Categories:
+  - Time
+License: MIT
+AuthorName: Jean-Luc Makiola
+SourceCode: https://gitea.jeanlucmakiola.de/makiolaj/calendula
+IssueTracker: https://gitea.jeanlucmakiola.de/makiolaj/calendula/issues
+Changelog: https://gitea.jeanlucmakiola.de/makiolaj/calendula/src/branch/main/CHANGELOG.md
+
+AutoName: Calendula
+
+RepoType: git
+Repo: https://gitea.jeanlucmakiola.de/makiolaj/calendula.git
+
+# IMPORTANT: the first build entry MUST target the first release that contains
+# `vcsInfo { include = false }` (added on branch chore/release-verification-process).
+# v2.7.1 and earlier embed META-INF/version-control-info.textproto, whose
+# env-dependent git metadata breaks reproducibility — they will NOT verify.
+# Update the versionName/versionCode/commit/Binaries below once that release is
+# tagged (e.g. v2.7.2 -> versionCode 20702). Values below are placeholders.
+Builds:
+  - versionName: 2.7.2
+    versionCode: 20702
+    commit: v2.7.2
+    subdir: app
+    gradle:
+      - yes
+    # No NDK / no flavors. The release buildType applies a signingConfig only
+    # when key.properties exists; on the buildserver it does not, so this
+    # produces the unsigned APK F-Droid compares against our binary.
+
+# SHA-256 of our app signing certificate (public; embedded in every published
+# APK). Locks F-Droid to publish only binaries signed with our key.
+AllowedAPKSigningKeys: 5cdaee8eb31cb0df9157c646ae3ec8b3dc43b5bb72624e088c9ddea0c4eb5ec1
+
+# Our own developer-signed APK for reproducible-build verification. %v -> the
+# versionName, so v2.7.2 resolves to calendula_v2.7.2.apk on the self-hosted repo.
+Binaries: https://apps.dev.jeanlucmakiola.de/dev/fdroid/repo/calendula_v%v.apk
+
+AutoUpdateMode: Version v%v
+UpdateCheckMode: Tags
+CurrentVersion: 2.7.2
+CurrentVersionCode: 20702