Add release/build tooling and README

- Real release build type: R8 shrinking + shrunk resources, with a keep
  rule for VeilHook specifically — LSPosed finds it by exact class name via
  the plaintext xposed_init asset, which R8 can't see, so obfuscating it
  would silently break module loading with no build error to point at why.
- Signing config that reads keystore.properties if present (gitignored,
  generated via scripts/generate-keystore.sh), falling back to debug
  signing otherwise so assembleRelease always produces something
  installable.
- scripts/release.sh builds and copies a version-stamped APK into dist/.
- GitHub Actions workflow building and publishing a release on any tag
  matching *.*.* (bare semver, e.g. 1.2.0 — no v prefix required), optionally
  using repo secrets for real release signing in CI.
- README covering setup, the feature table, and the DenyList gotcha.

No native code in this module, so a single APK already covers every
architecture — no per-ABI splitting needed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/release.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Builds a release APK and copies it into dist/ with a version-stamped filename.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+./gradlew assembleRelease
+
+VERSION=$(grep 'versionName' app/build.gradle.kts | head -1 | sed -E 's/.*"(.*)".*/\1/')
+APK="app/build/outputs/apk/release/app-release.apk"
+OUT="dist/veil-${VERSION}.apk"
+
+mkdir -p dist
+cp "$APK" "$OUT"
+
+echo "Built $OUT"