docs: document Android signing operations

[Qjzn]

Summary

• document the four Android release-signing secret boundaries
• define password rotation, certificate replacement, incident blocking and recovery validation
• make the final acceptance criterion of [Release] 在 GitHub Actions 配置 Android 正式签名 #27 explicit without publishing any secret value

Verification

• npm run verify:governance
• git diff --check

Closes #27 after the signed v2.7.4 Release and public APK verification.