Replace the hardcoded signing nsec with a `nsec1...` placeholder and add a
warning to always pass SIGN_WITH inline at runtime, never commit it.
Co-authored-by: shakespeare.diy <assistant@shakespeare.diy>
Add a prominent "Releasing a new version" runbook (bump both package.json
and build.gradle, git pull, npm run android:build, SIGN_WITH=... zsp publish
zapstore.yaml) with troubleshooting table. Keeps first-time keystore/setup
steps below for new machines.
Co-authored-by: shakespeare.diy <assistant@shakespeare.diy>