[oscar981-op]

Part of #842; refs #601.

The Android release workflow generated a new signing key whenever the permanent keystore was missing. Each resulting APK had a different identity, so Android refused to install it over an existing version. Release signing now requires the configured fixed keystore and password. Missing or malformed credentials fail the signing step before any APK output/upload; the workflow never generates a replacement identity.

The existing alias/key-password overrides remain supported. The temporary keystore is created outside the build tree with restrictive permissions and removed on both success and failure. Tests execute the workflow's actual shell with disposable signing-tool doubles, covering absent credentials, malformed base64, default/explicit aliases and passwords, signature/verification failures and cleanup. The test loader also accepts Windows CRLF checkouts; shell execution cases run on POSIX CI.

Validation on head c0b4090c47ae036d5326e812a59919ea9e9fcaa2:

• Updated to upstream main 846a2a67f73e3a3f937a51aa3ee52bdcd88d610d; all 23 conflict hunks were version fields. Signing shell and regression tests are unchanged by the merge.
• 35 targeted signing/release checks pass. Full unit suite: 6009 passed, 19 skipped, 0 failed (6028 total).
• TypeScript, Vite production build, version-field validation and diff checks pass.
• Version 2026.44.15 follows repository policy. Installer run started on this exact head; the unpublished draft release targets the same SHA. All five current-head upstream CI checks passed. The installer run completed with the expected missing-key gate and signing configuration failures; see results below.

This change does not recover the historical signing identity or make old installations update-compatible by itself. Maintainer investigation in #601 reports that the original PDF keystore still needs recovery or an explicit migration decision. No secret values were read and no replacement key was created. A configured permanent key is required before the Android release job can succeed. Desktop signing configuration and upstream review/merge rights also remain external prerequisites; retain draft status until required checks and review pass.

Installer results on c0b4090c47ae036d5326e812a59919ea9e9fcaa2: web bundle and MCPB succeeded. Android compilation reached the signing step, which correctly rejected the absent fixed key; no APK was uploaded. Windows jobs failed on the missing Azure signing endpoint, Linux on updater private-key decoding, and macOS was failure. The draft release remains unpublished. These are external signing prerequisites, not grounds to generate a new key or bypass the checks.