Migrate Android fastlane to play_publisher and add release workflows

[lohanidamodar]

Brings the Android fastlane setup in line with the other popupbits Flutter apps, and adds the GitHub Actions release pipelines for both stores.

iOS fastlane was already identical to that standard (match signing, App Store Connect API key, metadata under ios/fastlane/metadata/) — the only change there is setup_ci, see below.

Android fastlane → play_publisher

The Android Fastfile had grown to ~600 lines — mostly Supply::Client plumbing to work around two upstream fastlane bugs (#21530, #21529) and Google Play's draft-app restriction. That code now lives in fastlane-plugin-play_publisher, so the Fastfile here is just lane names.

All nine lanes are unchanged — build, internal, beta, release, upload_metadata, upload_screenshots, upload_listing, download_metadata, screenshots — verified with bundle exec fastlane lanes before and after.

One behaviour change: play_build now verifies release signing and fails if android/key.properties is missing, instead of silently producing a debug-signed AAB that Play would reject on upload. Set PLAY_PUBLISHER_VERIFY_SIGNING=false to opt out.

Release workflows

Workflow	Trigger	Does
Android Release	manual, pick internal / beta / release (+ release status)	decodes the keystore, flutter test, runs the matching fastlane lane
iOS Release	manual, pick beta (TestFlight) / release (App Store) / build	match signing, flutter build ios --no-codesign, then the lane; uploads the IPA as an artifact
Refresh Gemfile.lock	manual	regenerates both locks on a runner and commits them

The other popupbits apps call a shared reusable workflow (popupbits/.github) for the Android one. That repo is private, and GitHub does not let a public repo in a different org call a private reusable workflow, so the steps are inlined here instead.

Both Gemfile.locks are now committed — Bundler runs frozen in CI, so the release jobs fail without them. They were resolved in a ruby:3.2 container and carry the ruby, x86_64-linux and aarch64-linux platforms; a frozen bundle install was verified on Linux.

sync_signing in the iOS Fastfile now calls setup_ci, since match cannot install a certificate on a runner with no unlocked keychain. It is a no-op outside CI.

Also included

• android/fastlane/metadata/android/en-US/changelogs/1.txt — the changelogs directory only had a .gitkeep, so a versionCode 1 release would have shipped with no "what's new" text. Mirrors the existing iOS release_notes.txt.
• A ## Releasing section in the README covering both platforms' lanes, required env vars and the workflows.
• Fastlane's generated artifacts (fastlane/README.md, report.xml, .bundle/, vendor/) added to .gitignore.

Before the first run

Set the repository secrets listed at the top of each workflow file. Neither workflow has ever run, so treat the first internal / beta build as the smoke test.

Release enablement (later commits)

• google-services.json in CI. android/app/build.gradle.kts only applies the FCM Gradle plugin when the file is present, so a CI build without it succeeds and ships with push silently disabled. The workflow now decodes it from ANDROID_GOOGLE_SERVICES_JSON and warns loudly when the secret is unset.
• iOS build-number override. TestFlight rejects a re-upload at the same build number; the workflow takes an optional build_number at dispatch time instead of requiring a pubspec edit per retry.
• Play listing images. metadata/android/en-US/images/ did not exist, so upload_screenshots had nothing to upload and the listing could not be published. Added the required 512×512 icon.png and 1024×500 featureGraphic.png, generated from the mark and wordmark the web app uses. Screenshots still have to be captured by hand — Play needs at least two phone screenshots.