chore: android CI downloads Core's signed host library instead of building Core (private#972)

glab-devrequested to merge
chore/972-host-platform-download into main

What

android CI no longer builds Core (ADR-025, VCI01, SC-64, #972).

  • test:screenshots and the screenshot-record job download Core's signed host libvauchi_platform.so (vauchi-platform-host-linux/<version>) for the version of the published AAR, then check it:

    • cosign verifies the checksum signature, using Core's cosign.pub, the same key windows uses;
    • the library must match that checksum.

    A missing package fails the job. Before, it built Core from main.

  • verify:reproducible-so is gone. It moved to Core as verify:reproducible-android-so.

  • cosign.pub is added, with its REUSE annotation.

The Rust toolchain, the themes clone and the cargo cleanup go with the build. android CI now makes no cargo call.

Evidence

check-ci-yaml-structure passes, the YAML parses, and reuse lint is compliant.

Order

Merge only after a Core release ships build:platform-host-linux (core MR on chore/972-host-platform-package). The currently pinned version has no host package, so these jobs would fail.

cosign itself is checked against its pinned SHA-256 (sigstore's published checksum, and core's .cosign-install pin) before it runs.

🤖 Generated with Claude Code

Merge request reports