CI: validate the Play Store release pipeline end-to-end

Why

.github/workflows/ps-release.yml (the tag-driven production release pipeline) has zero runs in Actions history, and the repo has only one tag (v1.3.0) — it hasn't actually been exercised since at least Jan 2024. This gates whether any feature can reach users, not just Voice Selection, which is why it's detached from that epic rather than tracked as one of its child issues.

Scope

Validate the production release pipeline works end-to-end before trusting it for any real release.

Acceptance Criteria

• PLAY_STORE_CREDENTIALS (or equivalent secret) confirmed valid, rotated if stale
• Signing key used by ps-release.yml confirmed to match the key the app is actually published under on the Play Store
• versionCode generation (github.run_number) audited and confirmed ahead of the last actually-published build's version code
• A dry-run release to an internal/alpha track succeeds end-to-end

Out of Scope

• Any feature work gated on this — this ticket is purely about the pipeline's own health

Links

• Detached from #613 (Voice Selection) — this is general CI/release-health work, not feature-specific, per the spike review that originally surfaced it