dist: point F-Droid recipe at splash-tracked source

.gitignore

@@ -52,7 +52,8 @@ stats.json
 
 # Local/generated assets & incidental lockfiles (do not commit)
 /assets/
-/resources/
+/resources/*
+!/resources/splash.png
 /bun.lock
 cvm-server/bun.lock
 push-service/bun.lock

AGENTS.md

@@ -2469,8 +2469,10 @@ Rules:
 ### External submissions (do not fake)
 - **F-Droid main:** blocker is not code — it is a GitLab account, review and
   F-Droid's signing key. An agent cannot create/verify an external account or
-  pass review. Only start this when the owner supplies an account/email and
+  pass review. The recipe was locally test-built from a clean clone at
-  explicitly accepts the signature/data-loss implications.
+  `5ebf741` (unsigned APK); F-Droid CI is still authoritative. Only start this
+  when the owner supplies an account/email and explicitly accepts the
+  signature/data-loss implications.
 - **IzzyOnDroid:** app listing submissions are handled through their external
   listing/review process; source and APK are ready. Same account/email blocker.
 - **Obtanium:** there is no store submission. Users add the latest Forgejo

distribution/README.md

@@ -64,7 +64,10 @@ Store metadata: `fastlane/metadata/android/en-US/`
 
 The Android project is generated by Capacitor and intentionally not committed,
 so the prebuild steps must be verified in the F-Droid build environment before
-submitting to F-Droid main.
+submitting to F-Droid main. A fresh local clone at commit `5ebf741` completed
+the recipe's `npm ci → android:init → android:sync → assembleRelease` path and
+produced `app-release-unsigned.apk`; F-Droid CI is still the authoritative
+check.
 
 IzzyOnDroid submission details, when you want to send it:
 

distribution/fdroiddata/org.skatespots.app.yml

@@ -28,15 +28,18 @@ Repo: https://git.skate-spots.org/skatespots/SkateSpots.git
 Builds:
   - versionName: 1.7.61
     versionCode: 10761
-    commit: 50c95d0ff7e083f81eaeeee167c4cb7c68e3b038
+    commit: 5ebf741427303be0b0feeff5ce1d8420e2c0ddea
     subdir: .
     prebuild:
       - npm ci
       - npm run android:init
       - npm run android:sync
+      # F-Droid signs the APK itself. Remove the developer signing config so
+      # Gradle emits an unsigned release APK instead of requiring the keystore.
+      - sed -i '/signingConfig signingConfigs.release/d' android/app/build.gradle
     build:
       - cd android && ./gradlew assembleRelease --no-daemon
-    output: android/app/build/outputs/apk/release/app-release.apk
+    output: android/app/build/outputs/apk/release/app-release-unsigned.apk
     # The generated Android project is intentionally not committed. This
     # recipe recreates it with Capacitor before Gradle runs. F-Droid will sign
     # the resulting APK with its own key. The F-Droid buildserver supplies the