Release APK not fully reproducible: license metadata line endings + aboutlibraries index differ (v1.2.0 github flavor)

Summary: Third-party unsigned rebuild of the v1.2.0 GitHub-flavor release APK (KeyGo-v1.2.0-github_with_exclusive_updater.apk, sha256 0f3b07953021a5966688d6b4d77a530f872ec4b6e69bce1e625b66fb735bb767) from the v1.2.0 tag produces a near-identical APK: classes.dex and all code resources are byte-identical.

Remaining diffs (3 files of 1204 common ZIP entries):

• assets/30k.txt and res/7Y (Apache license text): CRLF vs LF line endings — official build has CRLF, ours LF (or vice versa); line sets identical after normalization
• res/7Y/res/Hz (aboutlibraries artifacts): size:offset columns differ; official also includes a keemobile/kotpass license entry absent in our build

Environment: OpenJDK 21.0.2, Android SDK, ./gradlew assembleGithubRelease, Linux. Repo CI builds with JDK 22 per .github/workflows/android-release.yml.

Hypotheses: line-ending normalization differs by OS/git config (maintainer macOS vs our Linux), and aboutlibraries index generation ordering/environment.

Suggestion: pin license generation (e.g. commit generated files, or normalize line endings + sort deterministically) to make the release APK fully third-party reproducible. Happy to provide full diff details.

Start with .github/workflows/android-release.yml and reproduce the GitHub flavor using ./gradlew assembleGithubRelease under the stated JDK and Linux environment. Compare the generated APK with the v1.2.0 artifact, focusing on assets/30k.txt, res/7Y, and res/Hz and their line endings, ordering, offsets, and license entries. Done means the rebuilt APK has no remaining ZIP-entry differences.