Sign release APKs with a fixed key from CI secrets

AGENTS.md

@@ -34,7 +34,7 @@ These come from the maintainer. Follow them without being asked again.
    `make apk` and `make android-studio` overwrite `android/engine.properties`
    with container-only paths and break an open Android Studio project. What you
    can do is dry-run patches (section 6) and run static consistency checks
-   (section 12). Say plainly in your report that the change was not built or
+   (section 13). Say plainly in your report that the change was not built or
    tested.
 3. **`engine/` and `android/gl4es-src/` are never edited.** They are vendored
    snapshots. Every change to them is a numbered patch under
@@ -141,7 +141,7 @@ not print it or commit it.
   `qs_config_frame_tick()`) is called from `xr_input.c`.
 - JNI symbol names must match the Java `native` declarations exactly
   (`Java_de_ladkau_questshock_<Class>_<method>`). A mismatch only fails at
-  runtime, so check it (section 12).
+  runtime, so check it (section 13).
 
 ### 4.5 Off-screen views (`OverlayPanel`, `MenuOverlay`, `KeyboardOverlay`)
 
@@ -337,7 +337,19 @@ or directory must also be declared as `inputs.file(...)`/`inputs.dir(...)` of
 The proprietary game data (`res/data/`, `res/sound/`) is never bundled or
 committed. The app refuses to start the engine until it is present.
 
-## 11. Code and documentation style
+## 11. Signing
+
+Distributed APKs are release builds signed with one fixed key, so users can
+update in place. `build-image/build-apk.sh` reads the key from
+`QUESTSHOCK_KEYSTORE`, `QUESTSHOCK_KEYSTORE_PASSWORD`, `QUESTSHOCK_KEY_ALIAS`
+and `QUESTSHOCK_KEY_PASSWORD`; `android/app/build.gradle` applies it to the
+`release` build type only when `QUESTSHOCK_KEYSTORE` is set. Both CI workflows
+decode it from the `ANDROID_KEYSTORE_BASE64` secret. Without a key the build is
+a debug APK (`...-debug.apk`), which is only for testing. Never commit a
+keystore or a password, print them, or put them in a workflow file (README
+section 4.3 lists the secrets).
+
+## 12. Code and documentation style
 
 - Match the surrounding code: naming, comment density, idiom. C is plain C with
   `static` helpers and `//` comments; Java targets Android API 34 and uses only the SDK plus
@@ -353,7 +365,7 @@ committed. The app refuses to start the engine until it is present.
 - English, French and German strings live in `Strings.java`; keep the three
   entries of each key on the same `put(...)`.
 
-## 12. Verifying a change without building
+## 13. Verifying a change without building
 
 Because you may not build (rule 2), check statically and say so in the report:
 
@@ -375,7 +387,7 @@ Then report what was checked, what was not (build, on-device behaviour), and
 any device check the maintainer should do (for example a new patch that may
 need `android/force-rebuild.sh`).
 
-## 13. Commit messages
+## 14. Commit messages
 
 Draft only (rule 1). Use a short imperative subject (about 70 characters), a
 blank line, then a body that explains what the change does and why: the