fix(android): publish unstripped crash symbols

[bytemain]

Problem

The Android SDK AAR correctly ships stripped native libraries, but the release pipeline did not preserve the matching unstripped libhandscrash.so files. Native crash frames such as libhandscrash.so+0x2e00 therefore cannot be symbolicated.

Changes

• Package the three release ABIs from CMake unstripped objects.
• Require build IDs and .debug_info; reject duplicate, missing, or stripped candidates.
• Publish the archive as the version-matched Maven native-symbols classifier.
• Use the fixed contract <abi>/libhandscrash.so plus manifest.json with SDK version, source commit, build IDs, and SHA-256 values.
• Upload the same archive as workflow evidence and set the SDK-reported/default publication version to 0.11.1.

Follow-up

Publish Android SDK 0.11.1 after merge so the mobile release pipeline can consume the classifier. Existing 0.10.2 and 0.11.0 packages are immutable and cannot receive a new classifier.

Testing

• packageReleaseNativeSymbols built all three ABIs and produced the archive.
• publishReleasePublicationToMavenLocal -PVERSION_NAME=0.11.1 succeeded and published AAR, sources, POM/module metadata, and hands-android-sdk-0.11.1-native-symbols.zip.
• Verified classifier build IDs match the stripped AAR libraries for all three ABIs, every classifier library retains .debug_info, and manifest build IDs/hashes match archive bytes.
• bash -n scripts/package_android_native_symbols.sh
• workflow YAML parse and git diff --check passed.

[bytemain]

Platform-owner review (Quinn/CC-Quiver-Owner): implementation matches the agreed contract — fail-closed on missing ABI / duplicate stale candidate / stripped .so / missing Build ID; manifest carries per-ABI build_id+sha256; zip layout /libhandscrash.so. Duplicate-candidate guard is a good call.

BLOCKING — version collision: 0.10.2 is already tagged AND published. Tag android-sdk-v0.10.2 (c4a9fe2) + successful publish run 29160289765 (2026-07-11), same for 0.11.0 (run 29162694904). GitHub Packages 409s on re-publishing an existing version, so 'merge → publish 0.10.2' fails at publish. Retarget everything to 0.11.1: HandsFeedback.SDK_VERSION, workflow_dispatch default, and mobile PR #1267's dependency + classifier resolution.

Heads-up for mobile review: 0.11.0's AAR added the delta-apply engine (com.eidu:archive-patcher), so 0.10.1 → 0.11.1 is a functional bump beyond symbols.

Non-blocking: the classifier artifact is wired unconditionally, so a JitPack build of the tag will also run the packaging script (needs bash + zip + readelf + python3 on the JitPack image). After tagging 0.11.1, smoke-check the JitPack build log; if that env lacks the tools, gate the artifact behind a property in a follow-up.