Build the phone's APK as a signed release, and say so in the render report

The phone has been running the debug build: build-apk.sh assembled it, and
nothing in the app or its report said which build a frame time came from.
A debuggable build runs Compose at a fraction of release speed, so the
tuning so far was measured against the wrong number. On the emulator, the
same fixture and gestures: measure 1.4ms mean / 14.7ms worst on debug,
0.8ms / 6.6ms on release.

build-apk.sh now assembles the release variant, signed with a key it
generates once under ~/.config/ai-app (beside the pinned CA, outside any
checkout). The report's header names the build. The one native library is
declared kept-with-symbols so packaging stops warning about an NDK the
build does not need.

Also: ui-sandbox.sh keep now keeps the config too. The server appends
spawned sessions and enrolled tokens to it, so regenerating it left the
transcripts on disk and the registry empty.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

AGENTS.md

@@ -203,6 +203,14 @@ first if a remote spawn ever mangles an argument.
   and lint, the app-side equivalent of the line above. Then `./build-apk.sh`
   to produce the APK to install on a phone (through Dev Updater), or
   `./run-android.sh` to build, install, and launch on the emulator.
+  **The phone gets the release build**, signed with a key the script
+  generates once under `~/.config/ai-app/release.jks` (never in the repo).
+  The emulator scripts stay on the debug build; a debuggable build runs
+  Compose at a fraction of release speed, so never read a frame time from
+  one as the app's -- the render report now says which build it came from.
+  Dev Updater lists every variant under `build/outputs/apk`, so pick
+  `release` there; a phone still holding the debug build has to uninstall
+  it first, since the two are signed differently.
 - **A row something is happening to is dimmed, drained of colour, inert,
   and says which operation in a word** -- `BusyItem`, used by both the
   session list and the import list so the appearance is learned once. The