build(todo): Todo's Android key pinned (ADR 0033, step 5)

The certificate of the key Todo's releases are signed with (alias
halkyon-todo), made in memory and kept in Proton Pass alone; the release
tool releases no APK signed otherwise.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0033-halkyon-todo.md

@@ -370,8 +370,8 @@ alternative was put to them, the choice is theirs.
    - **A key of its own** (as Train's D58): a PKCS #12 keystore at
      `~/.local/share/halkyon-todo/android-release.p12`, alias `halkyon-todo`, in Proton
      Pass as *Halkyon Todo – Android release keystore*, pinned in
-     `tool/release/todo-android-certificate.sha256` once the developer has made it;
-     until then the release tool releases nothing. *Alternative:* Learn's key, which
+     `tool/release/todo-android-certificate.sha256` (made 2 Nov 2026, in memory alone,
+     `$XDG_RUNTIME_DIR`, and kept nowhere but Proton Pass). *Alternative:* Learn's key, which
      would let one app's build pass for the other's update.
    - **The APK, in the F-Droid repository, and a snap** (the developer's, over the APK
      and F-Droid alone): the listing `app.halkyon.todo.yml` (category *Time*,

tool/release/todo-android-certificate.sha256

@@ -1,3 +1,3 @@
 # The SHA-256 of the certificate that signs Halkyon Todo's Android releases (key alias
-# halkyon-todo), as keytool prints it. tool/release.dart releases no APK signed otherwise,
-# and none at all until the key is made and its SHA-256 written below.
+# halkyon-todo), as keytool prints it. tool/release.dart releases no APK signed otherwise.
+89:12:93:D9:E2:17:47:55:F2:6B:08:E1:56:03:C7:E5:25:35:1E:E6:DB:AD:3F:23:5A:A4:F6:69:3D:9B:FF:CD