Per-commit preview builds for the Android host

New work: the existing distribution runs on merge, not per commit, so reviewing a host
change still means reading a diff.

Every commit on an open pull request should produce an installable build, stamped with the
commit that produced it, linked from the pull request. The stamp is what makes a preview
build trustworthy: a reviewer can confirm they installed the change under review rather
than a cached artifact.

Depends on: #675.

Steps

• Build an installable artifact on each pull request commit
• Stamp it with the commit under review
• Fail the job when the stamp is absent from the artifact
• Link the artifact from the pull request

Done when

Every commit on an open pull request yields an installable build whose displayed build
identifier matches that commit, and a build that cannot name its own commit fails.