Add Iris Android APK tooling

docs/PLAN.md

@@ -790,6 +790,33 @@ ssh case are one implementation.
     `--bind <ip>` is an *explicit, logged* override for development, a
     deliberate flag and never a fallback.
 
+## Iris Android application contract (2026-09-11)
+
+**An Iris Android application supplies an initialization function and its own
+state/resources; Iris supplies the JNI host and APK packager.**
+`#[iris::app_init]` marks the factory Android calls when it creates the Iris
+view. The macro target-gates the factory and generates the single exported
+`JNI_OnLoad` plus the concrete `android-view` registration callback. The
+function returns the application state, whose `AndroidAppState::Resources`
+associated type selects the resource bundle. `StdRsc` is the default, never a
+host requirement; a custom bundle works by implementing the narrow
+`AndroidResources` capabilities.
+
+`cargo-iris` is an installable Cargo subcommand, rather than a script callers
+must find inside an Iris checkout. `cargo iris apk` builds the Rust `cdylib`
+with cargo-ndk and packages it directly with the installed Android SDK tools:
+javac, d8, aapt2, jar, zipalign and apksigner. Gradle is not in the ordinary
+path because Iris's fixed Java view host has no Maven/AAR dependency or
+variant graph for it to manage. An application that later embeds Iris in a
+larger Gradle project can use that project as the packaging authority instead.
+
+The tool discovers and validates prerequisites but never installs an SDK,
+NDK, JDK, system image or emulator. `cargo iris run` requires an explicit
+device serial; it never chooses, creates, starts or stops a device. Debug APKs
+use Android's conventional debug key. Release signing requires the caller's
+explicit keystore, alias and environment-supplied passwords, since Iris must
+not create or own an application's permanent update identity.
+
 ## App (`app/`)
 
 One Rust crate owns platform-free client logic and Iris widget trees. Android