Build the phone's APK as a signed release, and say so in the render report

The phone has been running the debug build: build-apk.sh assembled it, and
nothing in the app or its report said which build a frame time came from.
A debuggable build runs Compose at a fraction of release speed, so the
tuning so far was measured against the wrong number. On the emulator, the
same fixture and gestures: measure 1.4ms mean / 14.7ms worst on debug,
0.8ms / 6.6ms on release.

build-apk.sh now assembles the release variant, signed with a key it
generates once under ~/.config/ai-app (beside the pinned CA, outside any
checkout). The report's header names the build. The one native library is
declared kept-with-symbols so packaging stops warning about an NDK the
build does not need.

Also: ui-sandbox.sh keep now keeps the config too. The server appends
spawned sessions and enrolled tokens to it, so regenerating it left the
transcripts on disk and the registry empty.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

app/ui-sandbox.sh

@@ -162,7 +162,15 @@ PROJECTS=$ROOT/home/.claude/projects/-home-bob-repos-sandbox
 if [ -z "${KEEP:-}" ]; then
     rm -rf "$ROOT/home" "$ROOT/sessions"
 fi
-rm -f "$ROOT/config.ron"
+# The server appends to this file: the tokens of phones enrolled against it
+# and every session spawned. Regenerating it under `keep` was what un-kept
+# the sessions -- their transcripts survived on disk while the registry that
+# lists them went back to empty -- so a kept sandbox keeps its config too.
+regen_config=1
+if [ -n "${KEEP:-}" ] && [ -f "$ROOT/config.ron" ]; then
+    regen_config=""
+fi
+[ -n "$regen_config" ] && rm -f "$ROOT/config.ron"
 mkdir -p "$PROJECTS" "$ROOT/sessions"
 if [ -z "${KEEP:-}" ]; then
 
@@ -231,6 +239,7 @@ awk -v mb="$BIG_MB" 'BEGIN {
 }' > "$big"
 fi
 
+if [ -n "$regen_config" ]; then
 cat >"$ROOT/config.ron" <<RON
 tokens: [
     (
@@ -260,6 +269,7 @@ setups: [
 ],
 sessions: [],
 RON
+fi
 
 echo "sandbox: building"
 (cd "$SERVER_DIR" && cargo build --quiet)