Ship v1: store-listed release

[mblackman]

Successor to #21. Tracks store-listed v1 release — closing the gap between green branch and store-listed v1.

Device-build foundation landed (signed AAB build path, icons, multi-arch CI, tag-driven versioning). Remaining gates:

P0 (block tag)

• R8/ProGuard JNI export survival probe — done, android-minify-probe CI job green (ShippingV1 S1: R8/ProGuard JNI export survival probe #50)
• Real-icon end-to-end verify — gated on example committing 1024×1024 assets/icon.png + icon= in project.ini (ShippingV1 S2: Real-icon end-to-end verify #51)
• Play internal-track upload automation — needs PLAY_SERVICE_ACCOUNT_JSON secret (ShippingV1 S3: Play internal-track upload automation #52)
• macOS codesign + notarize + staple — needs Apple Developer secrets (ShippingV1 S4: macOS codesign + notarize + staple #53)

P1 (during v1 window) — all landed

• Project scaffolder (octarine-new.{sh,ps1})
• License whitelist derived from vcpkg.json
• CI bake + AssetPipelineTest smoke on ship-release
• In-app Android license Activity
• App Store Connect API key auth — deferred, iOS-gated

P2 (post-launch)

• Replace ImageMagick PATH dep w/ stb_image_resize2
• Texture atlas
• Multi-ABI Gradle: structured plugin refactor
• Steam depot upload — parked, waiting for first project demand
• Audio normalize / glyph atlas / pak

iOS scope parked on defer/ios.