[🐛] Phone Auth `auth/app-not-authorized` — "play_integrity_token passed, but no matching SHA-256" on Play-signed build, despite correct SHA registration

### Issue
`signInWithPhoneNumber` fails on the **Play-distributed** Android build (installed
from Play internal testing) with:

```
[auth/app-not-authorized] This app is not authorized to use Firebase
Authentication... A play_integrity_token was passed, but no matching SHA-256 was
registered in the Firebase console. Please make sure that this application's
packageName/SHA256 pair is registered in the Firebase Console.
```

**Firebase test phone numbers work** (they bypass Play Integrity), so the failure
is isolated to Play Integrity token verification for real numbers.

### Environment
- `@react-native-firebase/app` + `/auth` **20.5.0**
- Expo SDK **51**, React Native **0.74**, `expo-build-properties` targetSdk **35**
- Managed/EAS build (`google-services.json` via `expo.android.googleServicesFile`)
- Android package `app.dingdrop.mobile`, Play **App Signing enabled**

### Everything verified correct
- App-signing key **SHA-256** (from Play Console → App signing) **and** SHA-1,
plus the upload key SHA-256/SHA-1, are **all registered** on the Firebase
Android app (confirmed in Project settings). App-signing SHA-256 matches Play
Console exactly.
- `google-services.json` is current and matches app ID / package / project number
/ api_key.
- **Play Integrity API enabled**; the Android API key's API restrictions include
Play Integrity API + Identity Toolkit API.
- Play Console → App integrity → **Integrity API Cloud project linked** to the
Firebase project (582947107702).
- **Clean, Play-only install** (all sideloaded builds uninstalled).
- Several **days** elapsed (well past SHA propagation).

### Question
With all of the above verified, why does the SHA-256 inside the
play_integrity_token not match the registered app-signing SHA-256? Is this a known
Play Integrity ↔ Firebase decryption/propagation issue, and is there a fix or
workaround for real-number phone sign-in on the Play build?

### Repro
1. Configure phone auth per docs (SHA-256 + Play Integrity API).
2. Install the Play-signed build from an internal-testing track.
3. Call `signInWithPhoneNumber(auth, '+')` → the error above.
(A configured Firebase test number succeeds.)

Play internal-testing ビルドで signInWithPhoneNumber 呼び出しから始め、issue に記載されている検証済みの Firebase と Play Console の設定を比較します。実際の電話番号と Firebase テスト番号で再現し、その後、このセットアップにおける Play Integrity トークンの package/SHA-256 不一致について、文書化された修正または workaround があるかどうかを確認します。

索引モデルが issue の本文から書いたものです。