feat: harden Android and prepare browser extension target

[sanskarIN]

Android production support

• hardens the Android manifest for resizable windows, RTL, optional touchscreen hardware, cleartext blocking, and local-state backup policy
• enables R8 code shrinking and resource shrinking for release builds
• adds a dedicated Android support audit and regression contract
• qualifies universal APK, split-per-ABI APKs, and AAB output with SHA-256 checksums
• documents device, signing, privacy, CI, and real-device qualification boundaries

Next-release browser extension preparation

• adds separate permission-free Manifest V3 templates for Chromium and Firefox
• keeps Firefox-specific Gecko identity/privacy metadata out of Chromium builds
• packages the existing Flutter web app instead of forking gameplay code
• derives extension version from pubspec.yaml
• adds a CSP-safe toolbar popup wrapper
• adds an end-to-end Chromium/Firefox packager plus readiness audit and tests
• adds a dedicated workflow that builds /app/-scoped Flutter web output, validates manifests, creates browser ZIPs/checksums, and uploads qualification artifacts
• documents local loading and future store-promotion gates

Release boundary

Version 2.0.12 remains the current six-target stable support contract. Browser Extension is deliberately marked prepared/automated but not stable-supported until a future version has real browser/store qualification evidence.

Validation expected from this PR

• permanent CI: format, analyze, full tests, release/source/platform audits, Android audit, extension audit, web build
• Platform Builds: Android APK/split APK/AAB plus existing Web/Linux/Windows/macOS/iOS builds
• Browser Extension Preparation: Chromium + Firefox package generation and checksums