ci(android): containerized APK build and CI job (Issue #45)

- scripts/setup-android-sdk.sh installs fixed versions of the Android
  command-line tools (checksum verified), platform 34, build-tools
  34.0.0 and NDK 28.2
- packaging/android/Containerfile + scripts/build-apk-container.sh build
  the APK in a container (podman or docker) with JDK 17 and Rust 1.99
- New CI job "Android APK (experimental)": builds the APK and keeps it
  as a workflow artifact, signed with the key from the secrets
  ANDROID_KEYSTORE_B64/ANDROID_KEYSTORE_PASS/ANDROID_KEY_ALIAS if set.
  Not part of the release yet; its failure doesn't block the release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/build-apk-container.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# ==============================================================================
+# Builds the APK inside the container from packaging/android/Containerfile (Issue #45),
+# with podman (preferred) or docker. Needs nothing else on the host.
+# Result: target/ink-notes_<version>_arm64.apk
+#
+# Signing key as in scripts/package-android.sh: ANDROID_KEYSTORE (path on the host),
+# ANDROID_KEYSTORE_PASS, ANDROID_KEY_ALIAS; otherwise a debug key (kept below
+# target/android-container/home, so that test builds can update each other).
+# ==============================================================================
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+cd "${ROOT_DIR}"
+
+if command -v podman >/dev/null 2>&1; then
+    ENGINE=podman
+    USER_ARGS=(--userns=keep-id)
+elif command -v docker >/dev/null 2>&1; then
+    ENGINE=docker
+    USER_ARGS=(--user "$(id -u):$(id -g)")
+else
+    echo "FEHLER: weder podman noch docker gefunden."
+    exit 1
+fi
+
+IMAGE="ink-notes-android"
+echo "=== Baue Container-Image ${IMAGE} ==="
+"${ENGINE}" build -t "${IMAGE}" -f packaging/android/Containerfile .
+
+mkdir -p target/android-container/home
+ARGS=(
+    --rm "${USER_ARGS[@]}"
+    -v "${ROOT_DIR}:/src"
+    -e HOME=/src/target/android-container/home
+    -e CARGO_TARGET_DIR=/src/target/android-container
+    # Downloaded crates stay between runs
+    -e CARGO_HOME=/src/target/android-container/cargo
+)
+if [ -n "${ANDROID_KEYSTORE:-}" ]; then
+    ARGS+=(
+        -v "$(realpath "${ANDROID_KEYSTORE}"):/keystore:ro"
+        -e ANDROID_KEYSTORE=/keystore
+        -e ANDROID_KEYSTORE_PASS -e ANDROID_KEY_ALIAS
+    )
+fi
+"${ENGINE}" run "${ARGS[@]}" "${IMAGE}" scripts/package-android.sh

scripts/setup-android-sdk.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# ==============================================================================
+# Installs the Android SDK parts that scripts/package-android.sh needs, in fixed versions
+# (Issue #45): command-line tools, platform 34, build-tools 34.0.0 and NDK 28.2.
+# Used by the CI and packaging/android/Containerfile; works for a local SDK as well.
+#
+#   ANDROID_HOME  target folder (default: ~/android-sdk)
+#
+# Needs curl, unzip and a JDK 17 or newer (sdkmanager is a Java program).
+# ==============================================================================
+set -euo pipefail
+
+ANDROID_HOME="${ANDROID_HOME:-${HOME}/android-sdk}"
+CMDLINE_TOOLS_ZIP="commandlinetools-linux-11076708_latest.zip"
+CMDLINE_TOOLS_SHA256="2d2d50857e4eb553af5a6dc3ad507a17adf43d115264b1afc116f95c92e5e258"
+PACKAGES=(
+    "platforms;android-34"
+    "build-tools;34.0.0"
+    "ndk;28.2.13676358"
+)
+
+SDKMANAGER="${ANDROID_HOME}/cmdline-tools/latest/bin/sdkmanager"
+if [ ! -x "${SDKMANAGER}" ]; then
+    echo "=== Lade Android Command-line Tools ==="
+    TMP="$(mktemp -d)"
+    trap 'rm -rf "${TMP}"' EXIT
+    curl -sSfL -o "${TMP}/${CMDLINE_TOOLS_ZIP}" \
+        "https://dl.google.com/android/repository/${CMDLINE_TOOLS_ZIP}"
+    echo "${CMDLINE_TOOLS_SHA256}  ${TMP}/${CMDLINE_TOOLS_ZIP}" | sha256sum -c -
+    unzip -q "${TMP}/${CMDLINE_TOOLS_ZIP}" -d "${TMP}"
+    mkdir -p "${ANDROID_HOME}/cmdline-tools"
+    rm -rf "${ANDROID_HOME}/cmdline-tools/latest"
+    mv "${TMP}/cmdline-tools" "${ANDROID_HOME}/cmdline-tools/latest"
+fi
+
+echo "=== Installiere ${PACKAGES[*]} nach ${ANDROID_HOME} ==="
+# sdkmanager ends with an error when `yes` is cut off by a closed pipe; that's fine
+(yes || true) | "${SDKMANAGER}" --sdk_root="${ANDROID_HOME}" --licenses >/dev/null
+"${SDKMANAGER}" --sdk_root="${ANDROID_HOME}" --install "${PACKAGES[@]}" >/dev/null
+echo "Android-SDK bereit: ${ANDROID_HOME}"