Workload install without build flags; CI variables and the APK key documented

dotnet workload install refuses -nologo. CLAUDE.md lists every variable and
secret the scripts and workflows read; the README gives the APK
certificate's SHA-256.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

README.md

@@ -29,6 +29,12 @@ me-web? sends nothing anywhere unless a check needs it, and lists every host it
 the end you can choose to share your findings to improve the next release's map of providers; you see exactly
 what is sent first, and you can delete it afterwards.
 
+## Verifying the Android app
+
+The APK is signed with the key whose certificate SHA-256 is
+`5f:52:cf:f4:f5:2f:4e:0b:6d:a6:cd:04:4b:fc:ea:f7:8d:1d:42:db:24:f2:47:06:02:db:7f:19:cb:fd:f8:46`
+(`apksigner verify --print-certs MeWeb-<version>-android.apk`). Every release also carries `SHA256SUMS.txt`.
+
 ## Building
 
 See `CLAUDE.md`. .NET 10, Avalonia 12.