android: build the signed APK's Rust with the release profile

Every APK so far carried a debug-profile libinkwell_ffi.so (opt-level 0),
because the workspace's release profile sets strip = true, which removes
the symbols uniffi's --library mode reads the interface from (run 4077).

The cargoNdk task now builds --release with two environment overrides, for
this build only:
- CARGO_PROFILE_RELEASE_STRIP=debuginfo keeps the symbol table. A release
  build has no debug info, so this keeps symbols and nothing else.
- CARGO_PROFILE_RELEASE_PANIC=unwind keeps a core panic reaching Kotlin as
  an exception, which the board shows as an error, not an app exit. Phones
  have always had unwind, because debug unwinds, so this keeps what they
  do.

Overrides rather than a profile of our own because cargo-ndk copies its -o
output from the release directory, and nothing says it handles another.
The desktop's binaries are unchanged. android.yml passes release on the
signed path; the unsigned debug path keeps debug.

Scribe #2810.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

android/ffi/src/lib.rs

@@ -24,14 +24,15 @@
 //! consistent; it simply hasn't stamped `last_sync_at`, which is only written after
 //! BOTH halves of a cycle succeed. The next cycle resumes from the stored cursor.
 //!
-//! ## A known consequence of the release profile
+//! ## A panic is an exception, not a crash
 //!
-//! The workspace sets `panic = "abort"` (Tauri's profile, for binary size). uniffi
-//! would otherwise catch a panic crossing the FFI boundary and raise it in Kotlin as
-//! an exception; with `abort` it takes the process down instead. That is the same
-//! behaviour the desktop already has, so no surface is worse off than another — but
-//! it is a deliberate cost, not an oversight. Revisit if a panic in the core ever
-//! turns out to be recoverable enough that a phone should survive it.
+//! The workspace's release profile sets `panic = "abort"` (Tauri's, for binary size).
+//! The Android build overrides it back to `unwind` (`CargoNdkBuild` in
+//! `app/build.gradle.kts`), so uniffi catches a panic crossing the FFI boundary and
+//! raises it in Kotlin as an exception, which the board shows as an error. Under
+//! `abort` the same panic would end the app. Every phone build had unwind before
+//! the release profile was used (debug unwinds), so keeping it changes nothing a
+//! phone does. The cost is library size (Scribe #2810).
 
 pub mod models;