An empty SDK build-tools glob was reported as found, so the signer check ran
nothing and refused a correctly signed APK with an empty signer. An unreadable
signer now warns and defers to the host's pinned-cert check; only a real
mismatch fails.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>