feat: fdroid-publish composite action (beta/stable, pinned cert + host key, no-downgrade guard)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -0,0 +1,40 @@
+# ci-actions
+
+Reusable Gitea Actions for SilverLined repos.
+
+## fdroid-publish
+
+Publishes an already-built, signed APK to a SilverLABS F-Droid channel:
+
+| channel | repo | who sees it |
+|---|---|---|
+| `beta` | `https://apps.silverlined.uk/fdroid-test/repo` | devices with SilverSTORE's "Beta channel" on |
+| `stable` | `https://apps.silverlined.uk/fdroid/repo` | the whole fleet (F-Droid auto-updates) |
+
+Same method as SilverMetal's `Publish-FdroidApp.ps1`: `scp` to `<repoRoot>/incoming`,
+run the host's `/srv/fdroid/bin/ingest.sh` (pinned-cert check, index rebuild under a
+lock), then read the published index back.
+
+```yaml
+- uses: https://git.silverlabs.uk/SilverLined/ci-actions/fdroid-publish@v1
+  with:
+    app: silverchat            # silverchat | silvervpn | silverstore
+    apk: path/to/app-release.apk
+    channel: beta              # default
+    version-code: ${{ github.run_number }}   # optional; read from the APK if omitted
+    ssh-key: ${{ secrets.FDROID_SSH_KEY }}
+```
+
+Safety:
+- The host refuses an APK not signed by the app's pinned cert (the action checks
+  first when `apksigner` is available).
+- A channel holds one APK per app (`ingest.sh` replaces `repo/<package>.apk`), so the
+  action **skips** any build whose versionCode is not newer than what the channel
+  already serves — an older, slower run can never roll a channel back.
+- `dry-run: 'true'` validates everything and stops before uploading.
+
+`FDROID_SSH_KEY` is a SilverLined org secret: the `fdroid-ci` key, authorised on
+`silverlined.uk` with `restrict,from="82.8.176.11"` (the lab's egress IP).
+
+Promotion to `stable` is manual: each app repo has a `Promote to F-Droid stable`
+workflow (dispatch with the tested tag).