android: build the signed APK's Rust with the release profile

Every APK so far carried a debug-profile libinkwell_ffi.so (opt-level 0),
because the workspace's release profile sets strip = true, which removes
the symbols uniffi's --library mode reads the interface from (run 4077).

The cargoNdk task now builds --release with two environment overrides, for
this build only:
- CARGO_PROFILE_RELEASE_STRIP=debuginfo keeps the symbol table. A release
  build has no debug info, so this keeps symbols and nothing else.
- CARGO_PROFILE_RELEASE_PANIC=unwind keeps a core panic reaching Kotlin as
  an exception, which the board shows as an error, not an app exit. Phones
  have always had unwind, because debug unwinds, so this keeps what they
  do.

Overrides rather than a profile of our own because cargo-ndk copies its -o
output from the release directory, and nothing says it handles another.
The desktop's binaries are unchanged. android.yml passes release on the
signed path; the unsigned debug path keeps debug.

Scribe #2810.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/android.yml

@@ -159,12 +159,10 @@ jobs:
             printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 -d > /tmp/inkwell-release.jks
             echo "variant=Release" >> $GITHUB_OUTPUT
             echo "label=release" >> $GITHUB_OUTPUT
-            # DEBUG profile, in a release APK, deliberately — see the note above
-            # the cargoNdk task. The release profile strips the symbols uniffi
-            # reads its metadata out of, so `generateUniffiBindings` fails
-            # outright (run 4077). Unpicking that is worth doing and is not worth
-            # blocking signed builds on.
-            echo "profile=debug" >> $GITHUB_OUTPUT
+            # An optimised .so for the APK people install. The cargoNdk task keeps
+            # the symbols uniffi reads its metadata from, which the release
+            # profile would strip (run 4077, Scribe #2810).
+            echo "profile=release" >> $GITHUB_OUTPUT
             echo "keystore=/tmp/inkwell-release.jks" >> $GITHUB_OUTPUT
             echo "apk=android/app/build/outputs/apk/release/app-release.apk" >> $GITHUB_OUTPUT
             echo "Signed release build — $version (versionCode $code)"
@@ -296,8 +294,9 @@ jobs:
         # upload is stored and invisible (Scribe 2270).
         uses: actions/upload-artifact@v7
         with:
-          # The APK's variant, NOT the Cargo profile — those are the same word
-          # for different things and the profile is pinned to debug (#2810).
+          # The APK's variant, NOT the Cargo profile. They are the same word for
+          # different things, and an unsigned debug APK still differs from a
+          # signed release one in more than its Rust.
           name: inkwell-android-${{ steps.build.outputs.label }}-${{ github.sha }}
           path: ${{ steps.build.outputs.apk }}
           if-no-files-found: error