ci(android): containerized APK build and CI job (Issue #45)

- scripts/setup-android-sdk.sh installs fixed versions of the Android
  command-line tools (checksum verified), platform 34, build-tools
  34.0.0 and NDK 28.2
- packaging/android/Containerfile + scripts/build-apk-container.sh build
  the APK in a container (podman or docker) with JDK 17 and Rust 1.99
- New CI job "Android APK (experimental)": builds the APK and keeps it
  as a workflow artifact, signed with the key from the secrets
  ANDROID_KEYSTORE_B64/ANDROID_KEYSTORE_PASS/ANDROID_KEY_ALIAS if set.
  Not part of the release yet; its failure doesn't block the release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packaging/android/Containerfile

@@ -0,0 +1,25 @@
+# Build environment for the Android APK (Issue #45): fixed versions of the JDK, Android SDK,
+# NDK and Rust, so that the APK can be built the same way anywhere.
+# Used by scripts/build-apk-container.sh (podman or docker).
+FROM docker.io/library/ubuntu:24.04
+
+ARG RUST_VERSION=1.99.0
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        ca-certificates curl unzip zip openjdk-17-jdk-headless build-essential pkg-config \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV ANDROID_HOME=/opt/android-sdk \
+    RUSTUP_HOME=/opt/rustup \
+    CARGO_HOME=/opt/cargo \
+    PATH=/opt/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+COPY scripts/setup-android-sdk.sh /tmp/setup-android-sdk.sh
+RUN /tmp/setup-android-sdk.sh && rm /tmp/setup-android-sdk.sh
+
+RUN curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal \
+        --default-toolchain "${RUST_VERSION}" --target aarch64-linux-android \
+    && chmod -R a+rwX /opt/cargo /opt/rustup
+
+WORKDIR /src