Release 2.5.9 with stable Android signing

[Qjzn]

What changed

• require the fixed official Android signing secrets for tagged releases
• verify the release APK certificate SHA-256 before upload
• remove the public Debug APK fallback and give local Debug builds a separate application id
• add the 2.5.9 release notes and update current Android/release documentation
• include the pending Windows bootstrap heartbeat and automatic local pairing-page improvements

Why

The v2.5.8 public asset was signed with an ephemeral Android Debug certificate. Android correctly rejected it when users attempted to update an installed official build with the same package id but a different certificate.

User impact

Official signed builds can update earlier official builds in place. Missing signing configuration now fails the release instead of publishing an incompatible APK. Local development builds can coexist with the official app.

Verification

• npm.cmd run verify:windows-productization
• npm.cmd run verify:release -- -RequireCleanGit -SchemaAudit skip
• Android assembleRelease assembleDebug
• release package: com.cxcodex.bridge, version 2.5.9, certificate SHA-256 f06cc88920b5f0cdc55c5ddcd51694fcf0131431900dbb24e8bd8820d965d4d4
• debug package: com.cxcodex.bridge.debug, version 2.5.9-debug
• candidate ZIP/APK checksum verification