feat: fdroid-publish composite action (beta/stable, pinned cert + host key, no-downgrade guard)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fdroid-publish/action.yml

@@ -0,0 +1,50 @@
+name: fdroid-publish
+description: >
+  Publish an already-built, signed APK to a SilverLABS F-Droid channel
+  (beta = apps.silverlined.uk/fdroid-test, stable = apps.silverlined.uk/fdroid).
+  The host verifies the signer against the app's pinned cert; the action refuses
+  to publish a versionCode that is not newer than what the channel serves, and
+  reads the index back afterwards.
+inputs:
+  app:
+    description: silverchat | silvervpn | silverstore
+    required: true
+  apk:
+    description: Path to the signed APK
+    required: true
+  channel:
+    description: beta | stable
+    required: false
+    default: beta
+  version-code:
+    description: The APK's versionCode (read from the APK with aapt2 when omitted)
+    required: false
+    default: ''
+  ssh-key:
+    description: Private key authorised for the repo host's incoming dir (secrets.FDROID_SSH_KEY)
+    required: true
+  dry-run:
+    description: "'true' to validate everything and stop before uploading"
+    required: false
+    default: 'false'
+  ssh-host:
+    required: false
+    default: silverlined.uk
+  ssh-user:
+    required: false
+    default: sysadmin
+runs:
+  using: composite
+  steps:
+    - name: Publish to F-Droid ${{ inputs.channel }}
+      shell: bash
+      env:
+        INPUT_APP: ${{ inputs.app }}
+        INPUT_APK: ${{ inputs.apk }}
+        INPUT_CHANNEL: ${{ inputs.channel }}
+        INPUT_VERSION_CODE: ${{ inputs.version-code }}
+        INPUT_SSH_KEY: ${{ inputs.ssh-key }}
+        INPUT_DRY_RUN: ${{ inputs.dry-run }}
+        INPUT_SSH_HOST: ${{ inputs.ssh-host }}
+        INPUT_SSH_USER: ${{ inputs.ssh-user }}
+      run: bash "${{ github.action_path }}/publish.sh"