ci: fail fast on mobile release access

[0xSero]

Purpose

Prevent mobile release jobs from spending an hour building before discovering that Apple or Google store access is missing or invalid.

Changes

• add a release preflight ahead of shared/native build preparation
• verify the Android upload keystore and prove the exact Google Play publishing permission by creating and immediately deleting an empty edit
• verify the ASC private key, distribution certificate, provisioning-profile identities, and authenticated app ID
• share the same checks between push and manual release workflows
• remove the per-release attempt to enable the Android Publisher API with the publishing service account
• document the one-time owner/admin bootstrap for both stores

Verification

• 7 Python unit/integration-boundary tests pass
• Python byte-compilation passes
• Bash syntax and ShellCheck pass for both preflight scripts
• Actionlint passes on all three changed workflows, ignoring only pre-existing custom-runner/style findings
• diff whitespace check passes
• the new ASC team key authenticates live and resolves KittyLitter, bundle com.sigkitten.litter, App Store ID 6759521788
• PR Mobile CI rebuilds shared Rust, iOS, and Android from a clean checkout

Remaining live gate

Apple API bootstrap is complete. Google Cloud still requires the signed-in account owner to accept its Terms of Service and enable androidpublisher.googleapis.com once. After that owner action, the main-only release environment can exercise the exact live preflight before any native release build.