Add a Google Play app-bundle release pipeline

[isomorphisms]

Summary

• build a signed release AAB for org.isomorphisms.wegert
• accept explicit, validated Play version codes and names
• keep the public debug key limited to debug builds
• retain full native debug symbols
• support artifact-only first uploads and credential-gated internal-track uploads
• document the protected environment and one-time Play Console setup

Safety boundary

PR validation uses a disposable key. No release credentials are committed, and the workflow has no production-track option.

This PR is stacked on the current analytic-continuation-view branch (PR #5).

Validation

• four native host test suites pass
• actionlint .github/workflows/google-play.yml
• git diff --check

Remote CI verifies the Android release bundle.