ci: build the release APK and check the JNI names

CI only ran analyze and test, so it would have passed for every commit that
carried the broken release APK. Adds a release-apk job that builds the
minified artifact, runs tool/check_jni_keep_rules.sh against it, and uploads
it — turning "the shipping artifact works" into something checked rather than
assumed at tag time.

Enables flutter-action's dependency cache on both jobs, and notes that the
test step now includes the layering guard.

This does not fix the current failures: every run so far has failed at
actions/checkout, before Flutter is reached, because the runner's job
containers cannot resolve the `gitea` hostname. That is runner configuration,
not workflow content.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/ci.yaml

@@ -17,6 +17,7 @@ jobs:
         with:
           flutter-version: '3.47.1'
           channel: 'stable'
+          cache: true
 
       - name: Get dependencies
         run: flutter pub get
@@ -24,5 +25,45 @@ jobs:
       - name: Analyze
         run: flutter analyze
 
+      # Includes test/architecture_test.dart, which fails the build if a layer
+      # boundary is crossed.
       - name: Run tests
         run: flutter test
+
+  release-apk:
+    name: Release APK
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+
+      - uses: subosito/flutter-action@v2
+        with:
+          flutter-version: '3.47.1'
+          channel: 'stable'
+          cache: true
+
+      - name: Get dependencies
+        run: flutter pub get
+
+      # The debug build does not minify, so it cannot catch an R8 problem. This
+      # job exists because a release APK that aborted on every test shipped
+      # once while the debug build passed every check.
+      - name: Build release APK
+        run: flutter build apk --release
+
+      # Building is not enough on its own: a renamed JNI callback still
+      # produces a successful build and a broken APK. This reads R8's mapping
+      # and the DEX string pool to confirm the names JNI resolves survived.
+      - name: Check JNI names survived minification
+        run: ./tool/check_jni_keep_rules.sh
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: app-release-apk
+          path: build/app/outputs/flutter-apk/app-release.apk
+          if-no-files-found: error