Build the shared F-Droid publishing tooling: sign, index, publish

Adds sign-apk.sh (align-check + apksigner), fdroid-update.sh (fdroid
update over a binary repo, signing the index with its own separate
key), publish.sh (S3-compatible upload) and the composite action
tying them together, matching weblib-ci's shape.

zipalign is not a standalone nixpkgs attribute; resolved by measurement
rather than assumption that Gradle/AGP already aligns its output (Android's
own docs, corroborated by fdroidserver never shelling out to zipalign) and
added check_zip_alignment.py as the safety net, since apksigner itself does
not check alignment at all. nixpkgs is pinned via a committed nixpkgs-pin
revision, since this repo has no flake.lock of its own for with-nixpkgs.sh
to read (fdroid-repo-ci#1, weblib-ci#9) -- a missing or malformed pin fails
loudly rather than degrading to an unpinned nix shell.

No consumer repo, bucket, hostname or channel name is hard-coded: which
repo holds the keys and runs the publish has already changed once during
this issue and may again, so every example uses a placeholder.

42 offline/local-only test assertions across five suites (run_tests.sh),
including fault injection on the alignment check, the password/argument
validation, and the with-nixpkgs.sh fail-loud paths.

Co-authored-by: bit <bit@das-labor.org>

action.yml

@@ -0,0 +1,39 @@
+# Makes sign-apk.sh, fdroid-update.sh, publish.sh and with-nixpkgs.sh
+# available to a workflow and reports where they are.
+#
+# Consume it with the **full URL**, the same reason recorded in weblib-ci's
+# README: `uses: owner/repo@main` resolves against the instance's default
+# actions URL rather than this host, and only the full URL form works while
+# the repository being referenced is private -- and the repository holding
+# the signing keys that consumes this one is private on purpose.
+#
+#   - uses: actions/checkout@v4
+#   - id: ci
+#     uses: https://git.chaosbit.de/weblib/fdroid-repo-ci@main
+#   - run: bash "${{ steps.ci.outputs.path }}/sign-apk.sh" ...
+#
+# Nothing here reads a secret or names a bucket, a keystore or a consumer
+# repo -- those all stay on the caller's side of this action's output path.
+name: F-Droid repo publishing tools
+description: >-
+  Shared, key-free tooling to align-check and sign a prebuilt APK, run
+  `fdroid update` over a binary repo, and publish the result to an
+  S3-compatible bucket. The caller supplies the keys, the bucket and the
+  APK; this action supplies the pinned toolchain and the scripts.
+
+outputs:
+  path:
+    description: >-
+      Directory holding with-nixpkgs.sh, nixpkgs-pin, sign-apk.sh,
+      fdroid-update.sh and publish.sh.
+    value: ${{ github.action_path }}
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: |
+        echo "fdroid-repo-ci tools at ${{ github.action_path }}"
+        for f in with-nixpkgs.sh nixpkgs-pin sign-apk.sh fdroid-update.sh publish.sh; do
+          test -f "${{ github.action_path }}/$f"
+        done