ci: add Android (Google Play internal track) release job

[sporaktu]

What

Extends the CircleCI release pipeline to ship Android to the Google Play internal testing track alongside the existing iOS → TestFlight flow, so a single v* tag releases both platforms.

Changes

• .circleci/config.yml
  • New android_build_and_submit job: EAS builds the .aab, --auto-submit uploads to the Google Play internal track. Submit creds (service-account .json) are injected into eas.json at runtime, never committed.
  • Added to the release workflow, parallel to and independent of iOS.
  • Soft-skips (via circleci-agent step halt → job success) when ANDROID_PACKAGE / GOOGLE_SERVICE_ACCOUNT_JSON_BASE64 are unset — so iOS can ship first without the release going red.
• docs/ci/circleci-testflight-setup.md
  • Corrected the iOS signing section: non-interactive CI cannot create the distribution cert from scratch (the test3 run hit "Distribution Certificate is not validated for non-interactive builds"). Documented the one-time interactive seeding, covering both the app and the share-extension target.
  • Added full Google Play setup: Developer account, app listing, service-account key, the auto-managed Android keystore, and the first-upload-may-be-manual gotcha.

app.config.ts already resolved ANDROID_PACKAGE on the EAS build server — no change needed there.

Validation

• YAML parses; both jobs are present in the release workflow.
• Both eas.json submit-injection scripts produce valid JSON (simulated).
• expo config resolves android.package from ANDROID_PACKAGE on the build server.

Still requires (portal/credentials, out of scope for this PR)

• iOS: one-time interactive credential seeding (§4) + set IOS_BUNDLE_ID as an EAS production env var.
• Android: Google Play account, app listing, service-account JSON → GOOGLE_SERVICE_ACCOUNT_JSON_BASE64 + ANDROID_PACKAGE in the hydra-cci context.