Add signed agent release workflow and relay installer

[turin-dev]

Summary

• add a tag-driven Android release workflow using the existing repository signing secrets
• build/test the release variant, sign it with the official keystore, verify the APK identity/signature, checksum it, and publish a signed preview release
• add GET /relay to the web app as a self-hosted Docker relay installer
• document curl -fsSL https://rish-mcp.turin.my/relay | sh

Verification

• web: npm run lint
• web: npm run build
• Android Docker toolchain: gradle --no-daemon testDebugUnitTest assembleRelease
• local temporary-key apksigner verify and manifest identity check
• local /relay response returned 200 and passed bash -n

Release boundary

The tag workflow publishes a GitHub preview release. Real-device pairing, relay/list_devices/run_shell validation, and upgrade validation remain required before a stable release.