[scarf005]

Publish the versionCode changelog instead of Release <tag>.

• Reject invalid release tags and APK version mismatches; pass release values through environment variables instead of shell source.
• Require localized changelogs and fill in missing released-version entries. Replace only blank or exact placeholder notes; preserve custom bodies.
• Use tooling from the workflow revision when rebuilding older tags.
• Use @david/dax for commands and Valibot for runtime validation.

Follow-up to release signing.

Testing

• Release regression tests: 12 pass, covering literal command arguments, malformed GitHub responses, invalid tags, missing notes, APK mismatches, and custom-body preservation. Deno format/lint/types, actionlint, and prek pass.
• ./gradlew testDebugUnitTest assembleDebug assembleRelease: 75 tests pass, one preview is skipped. The built APK reports dev.scarf.gc, code 6, version 0.1.1.
• Prepare historical v1.1.0 and v0.1.1 checkouts: matching changelogs and APK names are selected.
• Hosted signing and release publication were not exercised.

^{PR opened by gpt-6.1-sol default on pi}

_{PR opened by gpt-6.1-sol medium on pi}