Add release/build tooling and README

- Real release build type: R8 shrinking + shrunk resources, with a keep
  rule for VeilHook specifically — LSPosed finds it by exact class name via
  the plaintext xposed_init asset, which R8 can't see, so obfuscating it
  would silently break module loading with no build error to point at why.
- Signing config that reads keystore.properties if present (gitignored,
  generated via scripts/generate-keystore.sh), falling back to debug
  signing otherwise so assembleRelease always produces something
  installable.
- scripts/release.sh builds and copies a version-stamped APK into dist/.
- GitHub Actions workflow building and publishing a release on any tag
  matching *.*.* (bare semver, e.g. 1.2.0 — no v prefix required), optionally
  using repo secrets for real release signing in CI.
- README covering setup, the feature table, and the DenyList gotcha.

No native code in this module, so a single APK already covers every
architecture — no per-ABI splitting needed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/generate-keystore.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Creates a personal release-signing keystore and keystore.properties. Both are gitignored —
+# back them up yourself if you want release builds to keep the same signing identity across
+# reinstalls (Android treats a differently-signed update as a different app).
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+if [ -f keystore.properties ]; then
+    echo "keystore.properties already exists — remove it first if you want to regenerate." >&2
+    exit 1
+fi
+
+KEYSTORE_PATH="release.jks"
+ALIAS="veil"
+
+read -rsp "New keystore password: " STORE_PASSWORD
+echo
+read -rsp "Key password (leave blank to reuse the keystore password): " KEY_PASSWORD
+echo
+KEY_PASSWORD="${KEY_PASSWORD:-$STORE_PASSWORD}"
+
+keytool -genkeypair \
+    -keystore "$KEYSTORE_PATH" \
+    -alias "$ALIAS" \
+    -keyalg RSA \
+    -keysize 2048 \
+    -validity 10000 \
+    -storepass "$STORE_PASSWORD" \
+    -keypass "$KEY_PASSWORD" \
+    -dname "CN=Veil, OU=Personal, O=Personal, L=Unknown, ST=Unknown, C=US"
+
+cat > keystore.properties <<EOF
+storeFile=$KEYSTORE_PATH
+storePassword=$STORE_PASSWORD
+keyAlias=$ALIAS
+keyPassword=$KEY_PASSWORD
+EOF
+
+echo "Wrote $KEYSTORE_PATH and keystore.properties."

scripts/release.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Builds a release APK and copies it into dist/ with a version-stamped filename.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+./gradlew assembleRelease
+
+VERSION=$(grep 'versionName' app/build.gradle.kts | head -1 | sed -E 's/.*"(.*)".*/\1/')
+APK="app/build/outputs/apk/release/app-release.apk"
+OUT="dist/veil-${VERSION}.apk"
+
+mkdir -p dist
+cp "$APK" "$OUT"
+
+echo "Built $OUT"