Publish native Android control widgets

[toolazytoname]

What changed

• publish the complete Mobile Lab Control Android AppWidget source with bilingual UI
• add three independent Happy, llama.cpp, and model-profile widgets
• replace device-specific provider labels with a mode-600, allow-listed profile-slot map
• add a fixed Termux RUN_COMMAND bridge and explicit external-app installer
• update the deployment and validation Skills plus bilingual phone guides and the real OnePlus 8T case
• add Android build/permission CI and a release-signed APK workflow
• publish the release certificate while keeping the private key in local backup and GitHub Actions secrets

Why

The previous Termux:Widget controls opened terminal menus and could leave waiting shell processes. The native widgets now expose state and direct actions without numeric menus, while model selection remains configuration-only.

Security and behavior

• no android.permission.INTERNET
• no root, token, endpoint, CC Switch database, or arbitrary-command input
• exact Termux script path plus allow-list validation on both Android and shell sides
• release APKs live in GitHub Releases, never Git history
• private signing key is not part of this PR

Validation

• scripts/verify.sh
• both Skills pass quick_validate.py
• native bridge and installer tests pass on macOS Bash 3.2
• APK 0.4.0 builds locally, declares only com.termux.permission.RUN_COMMAND, and verifies with APK Signature Scheme v2/v3
• local release build certificate matches the committed SHA-256 fingerprint
• focused credential, private-path, provider-label, and listener scans pass