[codex] add dual-source Android updates for p6

[chenyuhao0628]

What changed

• add Cloudflare primary and GitHub fallback APK URLs to the Android update manifest
• retry only mirror availability and transport failures
• keep one shared size, hash, package, version, SDK, and signing-certificate verification path
• reject untrusted hosts, path variations, query injection, and reversed mirror order
• generate Cloudflare-first Android and Sparkle feeds in the release workflow
• add bilingual p6 release notes

Why

Android p5 can time out while downloading from github.com. p6 provides a Cloudflare static primary source while retaining GitHub as a fallback.

Validation

• ./gradlew --no-daemon test assembleDebug
• ./gradlew --no-daemon runUpdatePolicySelfTest
• pnpm run check:docs
• pnpm run check:release
• bash -n tools/generate-android-update-manifest.sh tools/verify-update-release.sh
• git diff --check