The Gradle distribution and dependencies are unverified

Two integrity gaps in the Android release path. Both are harmless today and stop being harmless the moment `~/.gradle` is cached between runs — which was the point of the abandoned attempt in #48, so they should be closed before that returns.

**The Gradle distribution is unverified.** `android/gradle/wrapper/gradle-wrapper.properties` sets `distributionUrl` for `gradle-8.14-all.zip` with no `distributionSha256Sum`. The wrapper accepts whatever it finds unpacked with an `.ok` marker, so the tool that compiles and signs the release artifacts is taken on trust. Gradle publishes the checksum; adding the line is one edit.

**Dependency verification is off.** There is no `android/gradle/verification-metadata.xml`, so every AAR and JAR that ends up inside the APK is resolved and used without a checksum or signature check.

Neither is reachable from a fork pull request today — `ci.yml` builds no Android and writes no Gradle cache, and fork caches are scope-isolated. Both are reachable by anyone who can push a tag.

The reason to fix them before caching returns: a cache turns a one-off into a persistent one. Caches survive between runs and the release path only runs on tags, so a single bad run would influence every subsequent signed release rather than one.

- [ ] Add `distributionSha256Sum` to `gradle-wrapper.properties`
- [ ] Decide on `verification-metadata.xml` — real value, but it needs regenerating whenever a dependency moves, so it is a maintenance commitment
- [ ] If `~/.gradle` is cached later, leave `~/.gradle/wrapper` out of the cached paths; the distribution download is not where the time goes