Audit PLAY_STORE_CREDENTIALS and signing key parity with the published app

Part of #626

Why

PLAY_STORE_CREDENTIALS was last rotated 2023-10-12 (~2.9 years old at time of writing) and has not been independently confirmed against the currently-published app on Play Store. Recent alpha-track runs show the credential can authenticate, create an edit, validate the track, and upload an artifact (it only fails later at commit, on an unrelated health-declaration gate — see the sibling issue under #626), which is indirect evidence it's still valid. That's not the same as confirming it matches the signing key the app is actually published under.

Scope

Confirm PLAY_STORE_CREDENTIALS is a currently-valid service account with the right permissions, and confirm the signing key used by ps-release.yml/pre-release-upload.yml matches the key the app is published under in Play Console, deciding whether either needs rotation.

Acceptance Criteria

• PLAY_STORE_CREDENTIALS confirmed valid (permissions/scope checked in Play Console, not just "upload didn't error")
• Signing key fingerprint used in CI (ENCODED_RELEASE_KEYSTORE) compared against the app signing key shown in Play Console's App signing page
• Decision recorded on whether PLAY_STORE_CREDENTIALS should be rotated given its age, even if currently functional

Out of Scope

• Actually rotating the credential unless the audit concludes it's necessary
• The versionCode bug and health declaration gate, tracked separately under #626

Links

• None